convert_library_version: 'v2 ; Compat Mode: [0] {[v2.1] (DEFAULT) Don''t use any Compatibility
  Mode}'
urn: urn:intuitem:risk:library:scf-2025.2.2
locale: en
ref_id: scf-2025.2.2
name: 'SCF: Secure Controls Framework (2025.2.2)'
description: 'SCF: Secure Controls Framework

  https://securecontrolsframework.com/about-us/'
copyright: SCF - https://securecontrolsframework.com/terms-conditions/
version: 1
publication_date: 2025-09-26
provider: SCF
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:scf-2025.2.2
    ref_id: scf-2025.2.2
    name: 'SCF: Secure Controls Framework (2025.2.2)'
    description: 'SCF: Secure Controls Framework

      https://securecontrolsframework.com/about-us/'
    min_score: 0
    max_score: 5
    scores_definition:
    - score: 0
      name: Not Performed
      description: null
    - score: 1
      name: Performed Informally
      description: null
    - score: 2
      name: Planned & Tracked
      description: null
    - score: 3
      name: Well Defined
      description: null
    - score: 4
      name: Quantitatively Controlled
      description: null
    - score: 5
      name: Continuously Improving
      description: null
    implementation_groups_definition:
    - ref_id: tier1
      name: Tier 1 - Strategic
      description: null
    - ref_id: tier2
      name: Tier 2 - Operational
      description: null
    - ref_id: tier3
      name: Tier 3 - Tactical
      description: null
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      assessable: false
      depth: 1
      ref_id: GOV
      name: Cybersecurity & Data Protection Governance
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-01
      name: Cybersecurity & Data Protection Governance Program
      description: Mechanisms exist to facilitate the implementation of cybersecurity
        & data protection governance controls.
      annotation: Does the organization facilitate the implementation of cybersecurity
        & data protection governance controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-01.1
      name: Steering Committee & Program Oversight
      description: Mechanisms exist to coordinate cybersecurity, data protection and
        business alignment through a steering committee or advisory board, comprised
        of key cybersecurity, data privacy and business executives, which meets formally
        and on a regular basis.
      annotation: Does the organization coordinate cybersecurity, data protection
        and business alignment through a steering committee or advisory board, comprised
        of key cybersecurity, data privacy and business executives, which meets formally
        and on a regular basis?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-01.2
      name: Status Reporting To Governing Body
      description: Mechanisms exist to provide governance oversight reporting and
        recommendations to those entrusted to make executive decisions about matters
        considered material to the organization's cybersecurity & data protection
        program.
      annotation: Does the organization provide governance oversight reporting and
        recommendations to those entrusted to make executive decisions about matters
        considered material to its cybersecurity & data protection program?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-01.3
      name: Commitment To Continual Improvements
      description: 'Mechanisms exist to commit appropriate resources needed for continual
        improvement of the organization''s cybersecurity & data privacy program, including:

        (1) Staffing;

        (2) Budget;

        (3) Processes; and

        (4) Technologies.'
      annotation: 'Does the organization commit appropriate resources needed for continual
        improvement of the organization''s cybersecurity & data privacy program, including:

        (1) Staffing;

        (2) Budget;

        (3) Processes; and

        (4) Technologies?'
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-02
      name: Publishing Cybersecurity & Data Protection Documentation
      description: Mechanisms exist to establish, maintain and disseminate cybersecurity
        & data protection policies, standards and procedures.
      annotation: Does the organization establish, maintain and disseminate cybersecurity
        & data protection policies, standards and procedures?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-02.1
      name: Exception Management
      description: Mechanisms exist to prohibit exceptions to standards, except when
        the exception has been formally assessed for risk impact, approved and recorded.
      annotation: Does the organization prohibit exceptions to standards, except when
        the exception has been formally assessed for risk impact, approved and recorded?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-03
      name: Periodic Review & Update of Cybersecurity & Data Protection Program
      description: Mechanisms exist to review the cybersecurity & data protection
        program, including policies, standards and procedures, at planned intervals
        or if significant changes occur to ensure their continuing suitability, adequacy
        and effectiveness.
      annotation: Does the organization review the cybersecurity & data protection
        program, including policies, standards and procedures, at planned intervals
        or if significant changes occur to ensure their continuing suitability, adequacy
        and effectiveness?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-04
      name: Assigned Cybersecurity & Data Protection Responsibilities
      description: Mechanisms exist to assign one or more qualified individuals with
        the mission and resources to centrally-manage, coordinate, develop, implement
        and maintain an enterprise-wide cybersecurity & data protection program.
      annotation: Does the organization assign one or more qualified individuals with
        the mission and resources to centrally-manage, coordinate, develop, implement
        and maintain an enterprise-wide cybersecurity & data protection program?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-04.1
      name: Stakeholder Accountability Structure
      description: Mechanisms exist to enforce an accountability structure so that
        appropriate teams and individuals are empowered, responsible and trained for
        mapping, measuring and managing data and technology-related risks.
      annotation: Does the organization enforce an accountability structure so that
        appropriate teams and individuals are empowered, responsible and trained for
        mapping, measuring and managing data and technology-related risks?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-04.2
      name: Authoritative Chain of Command
      description: Mechanisms exist to establish an authoritative chain of command
        with clear lines of communication to remove ambiguity from individuals and
        teams related to managing data and technology-related risks.
      annotation: Does the organization establish an authoritative chain of command
        with clear lines of communication to remove ambiguity from individuals and
        teams related to managing data and technology-related risks?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-05
      name: Measures of Performance
      description: Mechanisms exist to develop, report and monitor cybersecurity &
        data privacy program measures of performance.
      annotation: Does the organization develop, report and monitor cybersecurity
        & data privacy program measures of performance?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-05.1
      name: Key Performance Indicators (KPIs)
      description: Mechanisms exist to develop, report and monitor Key Performance
        Indicators (KPIs) to assist organizational management in performance monitoring
        and trend analysis of the cybersecurity & data privacy program.
      annotation: Does the organization develop, report and monitor Key Performance
        Indicators (KPIs) to assist organizational management in performance monitoring
        and trend analysis of the cybersecurity & data privacy program?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-05.2
      name: Key Risk Indicators (KRIs)
      description: Mechanisms exist to develop, report and monitor Key Risk Indicators
        (KRIs) to assist senior management in performance monitoring and trend analysis
        of the cybersecurity & data privacy program.
      annotation: Does the organization develop, report and monitor Key Risk Indicators
        (KRIs) to assist senior management in performance monitoring and trend analysis
        of the cybersecurity & data privacy program?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-06
      name: Contacts With Authorities
      description: Mechanisms exist to identify and document appropriate contacts
        with relevant law enforcement and regulatory bodies.
      annotation: Does the organization identify and document appropriate contacts
        with relevant law enforcement and regulatory bodies?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-07
      name: Contacts With Groups & Associations
      description: "Mechanisms exist to establish contact with selected groups and\
        \ associations within the cybersecurity & data privacy communities to: \n\
        (1) Facilitate ongoing cybersecurity & data privacy education and training\
        \ for organizational personnel;\n(2) Maintain currency with recommended cybersecurity\
        \ & data privacy practices, techniques and technologies; and\n(3) Share current\
        \ cybersecurity and/or data privacy-related information including threats,\
        \ vulnerabilities and incidents."
      annotation: "Does the organization establish contact with selected groups and\
        \ associations within the cybersecurity & data privacy communities to: \n\
        \ (1) Facilitate ongoing cybersecurity & data privacy education and training\
        \ for organizational personnel;\n (2) Maintain currency with recommended cybersecurity\
        \ & data privacy practices, techniques and technologies; and\n (3) Share current\
        \ cybersecurity and/or data privacy-related information including threats,\
        \ vulnerabilities and incidents?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-08
      name: Defining Business Context & Mission
      description: Mechanisms exist to define the context of its business model and
        document the organization's mission.
      annotation: Does the organization define the context of its business model and
        document the mission of the organization?
      implementation_groups:
      - tier1
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-09
      name: Define Control Objectives
      description: Mechanisms exist to establish control objectives as the basis for
        the selection, implementation and management of the organization's internal
        control system.
      annotation: Does the organization establish control objectives as the basis
        for the selection, implementation and management of its internal control system?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-10
      name: Data Governance
      description: Mechanisms exist to facilitate data governance to oversee the organization's
        policies, standards and procedures so that sensitive/regulated data is effectively
        managed and maintained in accordance with applicable statutory, regulatory
        and contractual obligations.
      annotation: Does the organization facilitate data governance to oversee its
        policies, standards and procedures so that sensitive/regulated data is effectively
        managed and maintained in accordance with applicable statutory, regulatory
        and contractual obligations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-11
      name: Purpose Validation
      description: Mechanisms exist to monitor mission/business-critical services
        or functions to ensure those resources are being used consistent with their
        intended purpose.
      annotation: Does the organization monitor mission/business-critical services
        or functions to ensure those resources are being used consistent with their
        intended purpose?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-12
      name: Forced Technology Transfer (FTT)
      description: Mechanisms exist to avoid and/or constrain the forced exfiltration
        of sensitive / regulated information (e.g., Intellectual Property (IP)) to
        the host government for purposes of market access or market management practices.
      annotation: Does the organization avoid and/or constrain the forced exfiltration
        of sensitive / regulated information (e.g., Intellectual Property (IP)) to
        the host government for purposes of market access or market management practices?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-13
      name: State-Sponsored Espionage
      description: Mechanisms exist to constrain the host government's ability to
        leverage the organization's technology assets for economic or political espionage
        and/or cyberwarfare activities.
      annotation: Does the organization constrain the host government's ability to
        leverage its technology assets for economic or political espionage and/or
        cyberwarfare activities?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-14
      name: Business As Usual (BAU) Secure Practices
      description: Mechanisms exist to incorporate cybersecurity & data privacy principles
        into Business As Usual (BAU) practices through executive leadership involvement.
      annotation: Does the organization incorporate cybersecurity & data privacy principles
        into Business As Usual (BAU) practices through executive leadership involvement?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-15
      name: Operationalizing Cybersecurity & Data Protection Practices
      description: Mechanisms exist to compel data and/or process owners to operationalize
        cybersecurity & data privacy practices for each system, application and/or
        service under their control.
      annotation: Does the organization compel data and/or process owners to operationalize
        cybersecurity & data privacy practices for each system, application and/or
        service under their control?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-15.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-15.1
      name: Select Controls
      description: Mechanisms exist to compel data and/or process owners to select
        required cybersecurity & data privacy controls for each system, application
        and/or service under their control.
      annotation: Does the organization compel data and/or process owners to select
        required cybersecurity & data privacy controls for each system, application
        and/or service under their control?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-15.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-15.2
      name: Implement Controls
      description: Mechanisms exist to compel data and/or process owners to implement
        required cybersecurity & data privacy controls for each system, application
        and/or service under their control.
      annotation: Does the organization compel data and/or process owners to implement
        required cybersecurity & data privacy controls for each system, application
        and/or service under their control?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-15.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-15.3
      name: Assess Controls
      description: Mechanisms exist to compel data and/or process owners to assess
        if required cybersecurity & data privacy controls for each system, application
        and/or service under their control are implemented correctly and are operating
        as intended.
      annotation: Does the organization compel data and/or process owners to assess
        if required cybersecurity & data privacy controls for each system, application
        and/or service under their control are implemented correctly and are operating
        as intended?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-15.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-15.4
      name: Authorize Systems, Applications & Services
      description: Mechanisms exist to compel data and/or process owners to obtain
        authorization for the production use of each system, application and/or service
        under their control.
      annotation: Does the organization compel data and/or process owners to obtain
        authorization for the production use of each system, application and/or service
        under their control?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-15.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-15.5
      name: Monitor Controls
      description: Mechanisms exist to compel data and/or process owners to monitor
        systems, applications and/or services under their control on an ongoing basis
        for applicable threats and risks, as well as to ensure cybersecurity & data
        privacy controls are operating as intended.
      annotation: Does the organization compel data and/or process owners to monitor
        systems, applications and/or services under their control on an ongoing basis
        for applicable threats and risks, as well as to ensure cybersecurity & data
        privacy controls are operating as intended?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-16
      name: Materiality Determination
      description: Mechanisms exist to define materiality threshold criteria capable
        of designating an incident as material.
      annotation: Does the organization define materiality threshold criteria capable
        of designating an incident as material?
      implementation_groups:
      - tier1
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-16.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-16.1
      name: Material Risks
      description: Mechanisms exist to define criteria necessary to designate a risk
        as a material risk.
      annotation: Does the organization define criteria necessary to designate a risk
        as a material risk?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-16.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-16.2
      name: Material Threats
      description: Mechanisms exist to define criteria necessary to designate a threat
        as a material threat.
      annotation: Does the organization define criteria necessary to designate a threat
        as a material threat?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-17
      name: Cybersecurity & Data Privacy Status Reporting
      description: Mechanisms exist to submit status reporting of the organization's
        cybersecurity and/or data privacy program to applicable statutory and/or regulatory
        authorities, as required.
      annotation: Does the organization submit status reporting of its cybersecurity
        and/or data privacy program to applicable statutory and/or regulatory authorities,
        as required?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:gov
      ref_id: GOV-18
      name: Quality Management System (QMS)
      description: Mechanisms exist to govern a Quality Management System (QMS) to
        ensure cybersecurity and data protection processes conform with applicable
        statutory, regulatory and/or contractual obligations.
      annotation: Does the organization govern a Quality Management System (QMS) to
        ensure cybersecurity and data protection processes conform with applicable
        statutory, regulatory and/or contractual obligations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      assessable: false
      depth: 1
      ref_id: AAT
      name: Artificial & Autonomous Technologies
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-01
      name: Artificial Intelligence (AI) & Autonomous Technologies Governance
      description: Mechanisms exist to ensure policies, processes, procedures and
        practices related to the mapping, measuring and managing of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent
        and implemented effectively.
      annotation: Does the organization ensure policies, processes, procedures and
        practices related to the mapping, measuring and managing of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-related risks are in place, transparent
        and implemented effectively?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-01.1
      name: AI & Autonomous Technologies-Related Legal Requirements Definition
      description: Mechanisms exist to identify, understand, document and manage applicable
        statutory and regulatory requirements for Artificial Intelligence (AI) and
        Autonomous Technologies (AAT).
      annotation: Does the organization identify, understand, document and manage
        applicable statutory and regulatory requirements for Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-01.2
      name: Trustworthy AI & Autonomous Technologies
      description: Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) are designed to be reliable, safe, fair, secure, resilient,
        transparent, explainable and data privacy-enhanced to minimize emergent properties
        or unintended consequences.
      annotation: Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) are designed to be reliable, safe, fair, secure, resilient,
        transparent, explainable and data privacy-enhanced to minimize emergent properties
        or unintended consequences?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-01.3
      name: AI & Autonomous Technologies Value Sustainment
      description: Mechanisms exist to sustain the value of deployed Artificial Intelligence
        (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization sustain the value of deployed Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-02
      name: Situational Awareness of AI & Autonomous Technologies
      description: Mechanisms exist to develop and maintain an inventory of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) (internal and third-party).
      annotation: Does the organization develop and maintain an inventory of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) (internal and third-party)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-02.1
      name: AI & Autonomous Technologies Risk Mapping
      description: Mechanisms exist to identify Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) in use and map those components to potential legal risks,
        including statutory and regulatory compliance requirements.
      annotation: Does the organization identify Artificial Intelligence (AI) and
        Autonomous Technologies (AAT) in use and map those components to potential
        legal risks, including statutory and regulatory compliance requirements?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-02.2
      name: AI & Autonomous Technologies Internal Controls
      description: Mechanisms exist to identify and document internal cybersecurity
        & data privacy controls for Artificial Intelligence (AI) and Autonomous Technologies
        (AAT).
      annotation: Does the organization identify and document internal cybersecurity
        & data privacy controls for Artificial Intelligence (AI) and Autonomous Technologies
        (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-02.3
      name: Adequate Protections For AI & Autonomous Technologies
      description: Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) include reasonable cybersecurity and data protections that
        are commensurate with assessed risks and threats.
      annotation: Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) include reasonable cybersecurity and data protections that
        are commensurate with assessed risks and threats?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-03
      name: AI & Autonomous Technologies Context Definition
      description: 'Mechanisms exist to establish and document the context surrounding
        Artificial Intelligence (AI) and Autonomous Technologies (AAT), including:

        (1) Intended purposes;

        (2) Potentially beneficial uses;

        (3) Context-specific laws and regulations;

        (4) Norms and expectations; and

        (5) Prospective settings in which the system(s) will be deployed.'
      annotation: "Does the organization establish and document the context surrounding\
        \ Artificial Intelligence (AI) and Autonomous Technologies (AAT), including:\n\
        \ (1) Intended purposes;\n (2) Potentially beneficial uses;\n (3) Context-specific\
        \ laws and regulations;\n (4) Norms and expectations; and\n (5) Prospective\
        \ settings in which the system(s) will be deployed?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-03.1
      name: AI & Autonomous Technologies Mission and Goals Definition
      description: Mechanisms exist to define and document the organization's mission
        and defined goals for Artificial Intelligence (AI) and Autonomous Technologies
        (AAT).
      annotation: Does the organization define and document its mission and defined
        goals for Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-04
      name: AI & Autonomous Technologies Business Case
      description: Mechanisms exist to benchmark capabilities, targeted usage, goals
        and expected benefits and costs of Artificial Intelligence (AI) and Autonomous
        Technologies (AAT).
      annotation: Does the organization benchmark capabilities, targeted usage, goals
        and expected benefits and costs of Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-04.1
      name: AI & Autonomous Technologies Potential Benefits Analysis
      description: Mechanisms exist to assess the potential benefits of proposed Artificial
        Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization assess the potential benefits of proposed
        Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-04.2
      name: AI & Autonomous Technologies Potential Costs Analysis
      description: Mechanisms exist to assess potential costs, including non-monetary
        costs, resulting from expected or realized Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)-related errors or system functionality and trustworthiness.
      annotation: Does the organization assess potential costs, including non-monetary
        costs, resulting from expected or realized Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)-related errors or system functionality and trustworthiness?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-04.3
      name: AI & Autonomous Technologies Targeted Application Scope
      description: Mechanisms exist to specify and document the targeted application
        scope of the proposed use and operation of Artificial Intelligence (AI) and
        Autonomous Technologies (AAT).
      annotation: Does the organization specify and document the targeted application
        scope of the proposed use and operation of Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-04.4
      name: AI & Autonomous Technologies Cost / Benefit Mapping
      description: Mechanisms exist to map risks and benefits for all components of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT), including
        third-party software and data.
      annotation: Does the organization map risks and benefits for all components
        of Artificial Intelligence (AI) and Autonomous Technologies (AAT), including
        third-party software and data?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-05
      name: AI & Autonomous Technologies Training
      description: Mechanisms exist to ensure personnel and external stakeholders
        are provided with position-specific risk management training for Artificial
        Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization ensure personnel and external stakeholders
        are provided with position-specific risk management training for Artificial
        Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-06
      name: AI & Autonomous Technologies Fairness & Bias
      description: Mechanisms exist to prevent Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) from unfairly identifying, profiling and/or statistically
        singling out a segmented population defined by race, religion, gender identity,
        national origin, religion, disability or any other politically-charged identifier.
      annotation: Does the organization prevent Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) from unfairly identifying, profiling and/or statistically
        singling out a segmented population defined by race, religion, gender identity,
        national origin, religion, disability or any other politically-charged identifier?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-07
      name: AI & Autonomous Technologies Risk Management Decisions
      description: Mechanisms exist to leverage decision makers from a diversity of
        demographics, disciplines, experience, expertise and backgrounds for mapping,
        measuring and managing Artificial Intelligence (AI) and Autonomous Technologies
        (AAT)-related risks.
      annotation: Does the organization leverage decision makers from a diversity
        of demographics, disciplines, experience, expertise and backgrounds for mapping,
        measuring and managing Artificial Intelligence (AI) and Autonomous Technologies
        (AAT)-related risks?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-07.1
      name: AI & Autonomous Technologies Impact Assessment
      description: Mechanisms exist to assess the impact(s) of proposed Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) on individuals, groups,
        communities, organizations and society (e.g., Fundamental Rights Impact Assessment
        (FRIA)).
      annotation: Does the organization assess the impact(s) of proposed Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) on individuals, groups,
        communities, organizations and society (e.g., Fundamental Rights Impact Assessment
        (FRIA))?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-07.2
      name: AI & Autonomous Technologies Likelihood & Impact Risk Analysis
      description: Mechanisms exist to define the potential likelihood and impact
        of each identified risk based on expected use and past uses of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) in similar contexts.
      annotation: Does the organization define the potential likelihood and impact
        of each identified risk based on expected use and past uses of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) in similar contexts?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-07.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-07.3
      name: AI & Autonomous Technologies Continuous Improvements
      description: Mechanisms exist to continuously improve Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) capabilities to maximize benefits and
        minimize negative impacts associated with AAT.
      annotation: Does the organization continuously improve Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) capabilities to maximize benefits and
        minimize negative impacts associated with AAT?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-08
      name: Assigned Responsibilities for AI & Autonomous Technologies
      description: 'Mechanisms exist to define and differentiate roles and responsibilities
        for:

        (1) Artificial Intelligence (AI) and Autonomous Technologies (AAT) configurations;
        and

        (2) Oversight of AAT systems.'
      annotation: 'Does the organization define and differentiate roles and responsibilities
        for:

        (1) Artificial Intelligence (AI) and Autonomous Technologies (AAT) configurations;
        and

        (2) Oversight of AAT systems?'
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-09
      name: AI & Autonomous Technologies Risk Profiling
      description: 'Mechanisms exist to document the risks and potential impacts of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that are:

        (1) Designed;

        (2) Developed;

        (3) Deployed;

        (4) Evaluated; and/or

        (5) Used.'
      annotation: 'Does the organization document the risks and potential impacts
        of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that are:

        (1) Designed;

        (2) Developed;

        (3) Deployed;

        (4) Evaluated; and/or

        (5) Used?'
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-09.1
      name: AI & Autonomous Technologies High Risk Designations
      description: 'Mechanisms exist to designate Artificial Intelligence (AI) and
        Autonomous Technologies (AAT) "High Risk" if one(1), or more, of the following
        criteria are met:

        (1) AAT is used as a safety component of a product or service;

        (2) AAT poses a significant risk of harm to an individual''s health, safety
        or fundamental rights; and/or

        (3) AAT materially influences the outcome of an individual''s decision making.'
      annotation: 'Does the organization designate Artificial Intelligence (AI) and
        Autonomous Technologies (AAT) "High Risk" if one(1), or more, of the following
        criteria are met:

        (1) AAT is used as a safety component of a product or service;

        (2) AAT poses a significant risk of harm to an individual''s health, safety
        or fundamental rights; and/or

        (3) AAT materially influences the outcome of an individual''s decision making?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10
      name: Artificial Intelligence Test, Evaluation, Validation & Verification (AI
        TEVV)
      description: Mechanisms exist to implement Artificial Intelligence Test, Evaluation,
        Validation & Verification (AI TEVV) practices to enable Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related
        conformity testing throughout the lifecycle of the AAT.
      annotation: Does the organization implement Artificial Intelligence Test, Evaluation,
        Validation & Verification (AI TEVV) practices to enable Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-related security, resilience and compliance-related
        conformity testing throughout the lifecycle of the AAT?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.1
      name: AI TEVV Trustworthiness Assessment
      description: Mechanisms exist to evaluate Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) for trustworthy behavior and operation including security,
        anonymization and disaggregation of captured and stored data for approved
        purposes.
      annotation: Does the organization evaluate Artificial Intelligence (AI) and
        Autonomous Technologies (AAT) for trustworthy behavior and operation including
        security, anonymization and disaggregation of captured and stored data for
        approved purposes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.2
      name: AI TEVV Tools
      description: Mechanisms exist to document test sets, metrics and details about
        the tools used during Artificial Intelligence Test, Evaluation, Validation
        & Verification (AI TEVV) practices.
      annotation: Does the organization document test sets, metrics and details about
        the tools used during Artificial Intelligence Test, Evaluation, Validation
        & Verification (AI TEVV) practices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.3
      name: AI TEVV Trustworthiness Demonstration
      description: 'Mechanisms exist to demonstrate the Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) to be deployed are:

        (1) Valid;

        (2) Reliable; and

        (3) Operate as intended, based on approved designs.'
      annotation: 'Does the organization demonstrate the Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) to be deployed are:

        (1) Valid;

        (2) Reliable; and

        (3) Operate as intended, based on approved designs?'
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.4
      name: AI TEVV Safety Demonstration
      description: Mechanisms exist to demonstrate the Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) to be deployed are safe, residual risk does
        not exceed the organization's risk tolerance and can fail safely, particularly
        if made to operate beyond its knowledge limits.
      annotation: Does the organization demonstrate the Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) to be deployed are safe, residual risk does
        not exceed its risk tolerance and can fail safely, particularly if made to
        operate beyond its knowledge limits?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.5
      name: AI TEVV Security & Resiliency Assessment
      description: Mechanisms exist to evaluate the security and resilience of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) to be deployed.
      annotation: Does the organization evaluate the security and resilience of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) to be deployed?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.6
      name: AI TEVV Transparency & Accountability Assessment
      description: Mechanisms exist to examine risks associated with transparency
        and accountability of Artificial Intelligence (AI) and Autonomous Technologies
        (AAT) to be deployed.
      annotation: Does the organization examine risks associated with transparency
        and accountability of Artificial Intelligence (AI) and Autonomous Technologies
        (AAT) to be deployed?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.7
      name: AI TEVV Privacy Assessment
      description: Mechanisms exist to examine the data privacy risk of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) to be deployed.
      annotation: Does the organization examine the data privacy risk of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) to be deployed?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.8
      name: AI TEVV Fairness & Bias Assessment
      description: Mechanisms exist to examine fairness and bias of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) to be deployed.
      annotation: Does the organization examine fairness and bias of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) to be deployed?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.9
      name: AI & Autonomous Technologies Model Validation
      description: Mechanisms exist to validate the Artificial Intelligence (AI) and
        Autonomous Technologies (AAT) model.
      annotation: Does the organization validate the Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) model?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.10
      name: AI TEVV Results Evaluation
      description: Mechanisms exist to evaluate the results of Artificial Intelligence
        Test, Evaluation, Validation & Verification (AI TEVV) to determine the viability
        of the proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization evaluate the results of Artificial Intelligence
        Test, Evaluation, Validation & Verification (AI TEVV) to determine the viability
        of the proposed Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.11
      name: AI TEVV Effectiveness
      description: Mechanisms exist to evaluate the effectiveness of the processes
        utilized to perform Artificial Intelligence Test, Evaluation, Validation &
        Verification (AI TEVV).
      annotation: Does the organization evaluate the effectiveness of the processes
        utilized to perform Artificial Intelligence Test, Evaluation, Validation &
        Verification (AI TEVV)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.12
      name: AI TEVV Comparable Deployment Settings
      description: Mechanisms exist to evaluate Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related performance or the assurance criteria demonstrated
        for conditions similar to deployment settings.
      annotation: Does the organization evaluate Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)-related performance or the assurance criteria
        demonstrated for conditions similar to deployment settings?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.13
      name: AI TEVV Post-Deployment Monitoring
      description: Mechanisms exist to proactively and continuously monitor deployed
        Artificial Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization proactively and continuously monitor deployed
        Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.14
      name: Updating AI & Autonomous Technologies
      description: Mechanisms exist to integrate continual improvements for deployed
        Artificial Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization integrate continual improvements for deployed
        Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.15
      name: AI TEVV Reporting
      description: Mechanisms exist to report the status and results of Artificial
        Intelligence Test, Evaluation, Validation & Verification (AI TEVV) to relevant
        stakeholders, including governing bodies, as required.
      annotation: Does the organization report the status and results of Artificial
        Intelligence Test, Evaluation, Validation & Verification (AI TEVV) to relevant
        stakeholders, including governing bodies, as required?
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.16
      name: AI TEVV Empirically Validated Methods
      description: Mechanisms exist to evaluate claims of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) model capabilities using empirically
        validated methods.
      annotation: Does the organization evaluate claims of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) model capabilities using empirically
        validated methods?
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.17
      name: AI TEVV Benchmarking Content Provenance
      description: Mechanisms exist to benchmark the verifiable lineage and origin
        of content used by Artificial Intelligence (AI) and Autonomous Technologies
        (AAT) according to industry-recognized standards.
      annotation: Does the organization benchmark the verifiable lineage and origin
        of content used by Artificial Intelligence (AI) and Autonomous Technologies
        (AAT) according to industry -recognized standards?
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-10.18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-10.18
      name: AI TEVV Model Collapse Mitigations
      description: 'Mechanisms exist to mitigate concerns of model collapse by:

        (1) Assessing the proportion of synthetic to non-synthetic training data;
        and

        (2) Verifying training data is not overly homogenous or Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) system-produced.'
      annotation: 'Does the organization mitigate concerns of model collapse by:

        (1) Assessing the proportion of synthetic to non-synthetic training data;
        and

        (2) Verifying training data is not overly homogenous or Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) system-produced?'
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-11
      name: Robust Stakeholder Engagement for AI & Autonomous Technologies
      description: Mechanisms exist to compel ongoing engagement with relevant Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) stakeholders to encourage
        feedback about positive, negative and unanticipated impacts.
      annotation: Does the organization compel ongoing engagement with relevant Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) stakeholders to encourage
        feedback about positive, negative and unanticipated impacts?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-11.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-11.1
      name: AI & Autonomous Technologies Stakeholder Feedback Integration
      description: Mechanisms exist to regularly collect, consider, prioritize and
        integrate risk-related feedback from those external to the team that developed
        or deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization regularly collect, consider, prioritize and
        integrate risk-related feedback from those external to the team that developed
        or deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-11.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-11.2
      name: AI & Autonomous Technologies Ongoing Assessments
      description: Mechanisms exist to conduct regular assessments of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) with independent assessors and stakeholders
        not involved in the development of the AAT.
      annotation: Does the organization conduct regular assessments of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) with independent assessors
        and stakeholders not involved in the development of the AAT?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-11.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-11.3
      name: AI & Autonomous Technologies End User Feedback
      description: Mechanisms exist to collect and integrate feedback from end users
        and impacted communities into Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related system evaluation metrics.
      annotation: Does the organization collect and integrate feedback from end users
        and impacted communities into Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related system evaluation metrics?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-11.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-11.4
      name: AI & Autonomous Technologies Incident & Error Reporting
      description: Mechanisms exist to communicate Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)-related incidents and/or errors to relevant
        stakeholders, including affected communities.
      annotation: Does the organization communicate Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)-related incidents and/or errors to relevant
        stakeholders, including affected communities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-12
      name: AI & Autonomous Technologies Intellectual Property Infringement Protections
      description: Mechanisms exist to prevent third-party Intellectual Property (IP)
        rights infringement by Artificial Intelligence (AI) and Autonomous Technologies
        (AAT).
      annotation: Does the organization prevent third-party Intellectual Property
        (IP) rights infringement by Artificial Intelligence (AI) and Autonomous Technologies
        (AAT)?
      implementation_groups:
      - tier1
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-12.1
      name: Data Source Identification
      description: Mechanisms exist to identify and document data sources utilized
        in the training and/or operation of Artificial Intelligence and Autonomous
        Technologies (AAT).
      annotation: Does the organization identify and document data sources utilized
        in the training and/or operation of Artificial Intelligence and Autonomous
        Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-12.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-12.2
      name: Data Source Integrity
      description: Mechanisms exist to protect the integrity of source data to prevent
        accidental contamination or malicious corruption (e.g., data poisoning) that
        could compromise the performance of Artificial Intelligence and Autonomous
        Technologies (AAT).
      annotation: Does the organization protect the integrity of source data to prevent
        accidental contamination or malicious corruption (e.g., data poisoning) that
        could compromise the performance of Artificial Intelligence and Autonomous
        Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-12.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-12.3
      name: Data Source Lineage & Origin Disclosure
      description: "Mechanisms exist to ensure Artificial Intelligence and Autonomous\
        \ Technologies (AAT) publicly disclose information with sufficient detail\
        \ to assess:\n(1) Content lineage; and \n(2) The origin of data used by the\
        \ AAT."
      annotation: "Does the organization ensure Artificial Intelligence and Autonomous\
        \ Technologies (AAT) publicly disclose information with sufficient detail\
        \ to assess:\n(1) Content lineage; and \n(2) The origin of data used by the\
        \ AAT?"
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-12.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-12.4
      name: Digital Content Modification Logging
      description: "Mechanisms exist to ensure Artificial Intelligence and Autonomous\
        \ Technologies (AAT):\n(1) Enable auditing of content modifications; and \n\
        (2) Generate event logs for content-related changes."
      annotation: "Does the organization ensure Artificial Intelligence and Autonomous\
        \ Technologies (AAT):\n(1) Enable auditing of content modifications; and \n\
        (2) Generate event logs for content-related changes?"
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-13
      name: AI & Autonomous Technologies Stakeholder Diversity
      description: Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) stakeholder competencies, skills and capacities incorporate
        demographic diversity, broad domain and user experience expertise.
      annotation: Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) stakeholder competencies, skills and capacities incorporate
        demographic diversity, broad domain and user experience expertise?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-13.1
      name: AI & Autonomous Technologies Stakeholder Competencies
      description: Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related operator and practitioner proficiency requirements
        for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are defined,
        assessed and documented.
      annotation: Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related operator and practitioner proficiency requirements
        for Artificial Intelligence (AI) and Autonomous Technologies (AAT) are defined,
        assessed and documented?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-14
      name: AI & Autonomous Technologies Requirements Definitions
      description: Mechanisms exist to take socio-technical implications into account
        to address risks associated with Artificial Intelligence (AI) and Autonomous
        Technologies (AAT).
      annotation: Does the organization take socio-technical implications into account
        to address risks associated with Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-14.1
      name: AI & Autonomous Technologies Implementation Tasks Definition
      description: Mechanisms exist to define the tasks that Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) will support (e.g., classifiers, generative
        models, recommenders).
      annotation: Does the organization define the tasks that Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) will support (e.g., classifiers, generative
        models, recommenders)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-14.2
      name: AI & Autonomous Technologies Knowledge Limits
      description: Mechanisms exist to identify and document knowledge limits of Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) to provide sufficient
        information to assist relevant stakeholder decision making.
      annotation: Does the organization identify and document knowledge limits of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) to provide
        sufficient information to assist relevant stakeholder decision making?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-15
      name: AI & Autonomous Technologies Viability Decisions
      description: Mechanisms exist to define the criteria as to whether Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) achieved intended purposes
        and stated objectives to determine whether its development or deployment should
        proceed.
      annotation: Does the organization define the criteria as to whether Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) achieved intended purposes
        and stated objectives to determine whether its development or deployment should
        proceed?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-15.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-15.1
      name: AI & Autonomous Technologies Negative Residual Risks
      description: Mechanisms exist to identify and document negative, residual risks
        (defined as the sum of all unmitigated risks) to both downstream acquirers
        and end users of Artificial Intelligence (AI) and Autonomous Technologies
        (AAT).
      annotation: Does the organization identify and document negative, residual risks
        (defined as the sum of all unmitigated risks) to both downstream acquirers
        and end users of Artificial Intelligence (AI) and Autonomous Technologies
        (AAT)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-15.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-15.2
      name: Responsibility To Supersede, Deactivate and/or Disengage AI & Autonomous
        Technologies
      description: Mechanisms exist to define the criteria and responsible party(ies)
        for superseding, disengaging or deactivating Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) that demonstrate performance or outcomes
        inconsistent with intended use.
      annotation: Does the organization define the criteria and responsible party(ies)
        for superseding, disengaging or deactivating Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) that demonstrate performance or outcomes
        inconsistent with intended use?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16
      name: AI & Autonomous Technologies Production Monitoring
      description: Mechanisms exist to monitor the functionality and behavior of the
        deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization monitor the functionality and behavior of
        the deployed Artificial Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.1
      name: AI & Autonomous Technologies Measurement Approaches
      description: Mechanisms exist to measure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related risks to deployment context(s) through review and
        consultation with industry experts, domain specialists and end users.
      annotation: Does the organization measure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related risks to deployment context(s) through review and
        consultation with industry experts, domain specialists and end users?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.2
      name: Measuring AI & Autonomous Technologies Effectiveness
      description: Mechanisms exist to regularly assess the effectiveness of existing
        controls, including reports of errors and potential impacts on affected communities.
      annotation: Does the organization regularly assess the effectiveness of existing
        controls, including reports of errors and potential impacts on affected communities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.3
      name: Unmeasurable AI & Autonomous Technologies Risks
      description: Mechanisms exist to identify and document unmeasurable risks or
        trustworthiness characteristics.
      annotation: Does the organization identify and document unmeasurable risks or
        trustworthiness characteristics?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.4
      name: Efficacy of AI & Autonomous Technologies Measurement
      description: Mechanisms exist to gather and assess feedback about the efficacy
        of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related
        measurements.
      annotation: Does the organization gather and assess feedback about the efficacy
        of Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related
        measurements?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.5
      name: AI & Autonomous Technologies Domain Expert Reviews
      description: Mechanisms exist to utilize input from domain experts and relevant
        stakeholders to validate whether the Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) perform consistently, as intended.
      annotation: Does the organization utilize input from domain experts and relevant
        stakeholders to validate whether the Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) perform consistently, as intended?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.6
      name: AI & Autonomous Technologies Performance Changes
      description: Mechanisms exist to evaluate performance improvements or declines
        with domain experts and relevant stakeholders to define context-relevant risks
        and trustworthiness issues.
      annotation: Does the organization evaluate performance improvements or declines
        with domain experts and relevant stakeholders to define context-relevant risks
        and trustworthiness issues?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.7
      name: Pre-Trained AI & Autonomous Technologies Models
      description: Mechanisms exist to validate the information source(s) and quality
        of pre-trained models used in Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) training, maintenance and improvement-related activities.
      annotation: Does the organization validate the information source(s) and quality
        of pre-trained models used in Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) training, maintenance and improvement-related activities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.8
      name: AI & Autonomous Technologies Event Logging
      description: 'Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) system event logging capabilities at a minimum provide:

        (1) Start date, start time, end date and end time for each use;

        (2) Database(s) against which input data has been checked by the system;

        (3) Input data for which the search has led to a match; and

        (4) Identification of individual(s) involved in the verification of the results.'
      annotation: 'Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) system event logging capabilities at a minimum provide:

        (1) Start date, start time, end date and end time for each use;

        (2) Database(s) against which input data has been checked by the system;

        (3) Input data for which the search has led to a match; and

        (4) Identification of individual(s) involved in the verification of the results?'
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.9
      name: Serious Incident Reporting For AI & Autonomous Technologies
      description: Mechanisms exist to report any serious incident involving operational
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) to relevant
        authorities as to when and where the serious incident occurred, in accordance
        with mandated reporting timelines.
      annotation: Does the organization report any serious incident involving operational
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) to relevant
        authorities as to when and where the serious incident occurred, in accordance
        with mandated reporting timelines?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-16.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-16.10
      name: Serious Incident Root Cause Analysis (RCA) For AI & Autonomous Technologies
      description: "Mechanisms exist to perform an investigation when there is a serious\
        \ incident involving operational Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) that documents a:\n(1) Root Cause Analysis (RCA);\n(2)\
        \ Risk assessment of the incident; and \n(3) Description of corrective actions\
        \ taken, including measures implemented to prevent a recurrence of the incident."
      annotation: "Does the organization perform an investigation when there is a\
        \ serious incident involving operational Artificial Intelligence (AI) and\
        \ Autonomous Technologies (AAT) that documents a:\n(1) Root Cause Analysis\
        \ (RCA);\n(2) Risk assessment of the incident; and \n(3) Description of corrective\
        \ actions taken, including measures implemented to prevent a recurrence of\
        \ the incident?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-17
      name: AI & Autonomous Technologies Harm Prevention
      description: Mechanisms exist to proactively prevent harm by regularly identifying
        and tracking existing, unanticipated and emergent Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-related risks.
      annotation: Does the organization proactively prevent harm by regularly identifying
        and tracking existing, unanticipated and emergent Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-related risks?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-17.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-17.1
      name: AI & Autonomous Technologies Human Subject Protections
      description: Mechanisms exist to protect human subjects from harm.
      annotation: Does the organization protect human subjects from harm?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-17.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-17.2
      name: AI & Autonomous Technologies Environmental Impact & Sustainability
      description: Mechanisms exist to assess and document the environmental impacts
        and sustainability of Artificial Intelligence (AI) and Autonomous Technologies
        (AAT).
      annotation: Does the organization assess and document the environmental impacts
        and sustainability of Artificial Intelligence (AI) and Autonomous Technologies
        (AAT)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-17.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-17.3
      name: Previously Unknown AI & Autonomous Technologies Threats & Risks
      description: Mechanisms exist to respond to and recover from a previously unknown
        Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risk
        when it is identified.
      annotation: Does the organization respond to and recover from a previously unknown
        Artificial Intelligence (AI) and Autonomous Technologies (AAT)-related risk
        when it is identified?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-17.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-17.4
      name: Novel Risk Assessment Methods & Technologies
      description: "Mechanisms exist to utilize novel methods and technologies for\
        \ the measurement of Artificial Intelligence (AI) and Autonomous Technologies\
        \ (AAT)-related risks to evaluate, if applicable:\n(1) Content provenance;\n\
        (2) O\uFB00ensive cyber capabilities; \n(3) Chemical, Biological, Radiological\
        \ or Nuclear (CBRN) weapons; and/or \n(4) Other dangerous materials or agents."
      annotation: "Does the organization utilize novel methods and technologies for\
        \ the measurement of Artificial Intelligence (AI) and Autonomous Technologies\
        \ (AAT)-related risks to evaluate, if applicable:\n(1) Content provenance;\n\
        (2) O\uFB00ensive cyber capabilities; \n(3) Chemical, Biological, Radiological\
        \ or Nuclear (CBRN) weapons; and/or \n(4) Other dangerous materials or agents?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-17.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-17.5
      name: Fine Tuning Risk Mitigation
      description: Mechanisms exist to ensure actions to fine-tune Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) do not compromise existing safety and/or
        security controls.
      annotation: Does the organization ensure actions to fine-tune Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) do not compromise existing safety and/or
        security controls?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-18
      name: AI & Autonomous Technologies Risk Tracking Approaches
      description: Mechanisms exist to track Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related risks are difficult to assess using currently available
        measurement techniques or where metrics are not yet available.
      annotation: Does the organization track Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related risks are difficult to assess using currently available
        measurement techniques or where metrics are not yet available?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-18.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-18.1
      name: AI & Autonomous Technologies Risk Response
      description: Mechanisms exist to prioritize, respond to and remediate Artificial
        Intelligence (AI) and Autonomous Technologies (AAT)-related risks based on
        assessments and other analytical output.
      annotation: Does the organization prioritize, respond to and remediate Artificial
        Intelligence (AI) and Autonomous Technologies (AAT)-related risks based on
        assessments and other analytical output?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19
      name: AI & Autonomous Technologies Conformity
      description: 'Mechanisms exist to ensure deployed Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) conform to applicable statutory and regulatory
        requirements, based on:

        (1) Defined use cases;

        (2) Geographic markets; and

        (3) Use of Intellectual Property (IP).'
      annotation: 'Does the organization ensure deployed Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) conform to applicable statutory and regulatory
        requirements, based on:

        (1) Defined use cases;

        (2) Geographic markets; and

        (3) Use of Intellectual Property (IP)?'
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.1
      name: Manipulative or Deceptive Techniques
      description: Mechanisms exist to prohibit the sale, deployment and/or use of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that utilize
        manipulative or deceptive techniques (including biased data) to impair an
        individual's ability to make a reasonably informed decision.
      annotation: Does the organization prohibit the sale, deployment and/or use of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that utilize
        manipulative or deceptive techniques (including biased data) to impair an
        individual's ability to make a reasonably informed decision?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.2
      name: Materially Distorting Behaviors
      description: "Mechanisms exist to prohibit the sale, deployment and/or use of\
        \ Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploit\
        \ a human subject to materially affect a targeted behavior due to their:\n\
        (1) Age;\n(2) Disability; or \n(3) Specific social or economic situation."
      annotation: "Does the organization prohibit the sale, deployment and/or use\
        \ of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that exploit\
        \ a human subject to materially affect a targeted behavior due to their:\n\
        (1) Age;\n(2) Disability; or \n(3) Specific social or economic situation?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.3
      name: Social Scoring
      description: "Mechanisms exist to prohibit the sale, deployment and/or use of\
        \ Artificial Intelligence (AI) and Autonomous Technologies (AAT) that: \n\
        (1) Evaluate human subjects over a certain period of time based on their social\
        \ behavior or known, inferred or predicted personal or personality characteristics;\
        \ and\n(2) Assign a \"social score\" branding or equivalent classification."
      annotation: "Does the organization prohibit the sale, deployment and/or use\
        \ of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:\
        \ \n(1) Evaluate human subjects over a certain period of time based on their\
        \ social behavior or known, inferred or predicted personal or personality\
        \ characteristics; and\n(2) Assign a \"social score\" branding or equivalent\
        \ classification?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.4
      name: Detrimental or Unfavorable Treatment
      description: 'Mechanisms exist to prohibit the sale, deployment and/or use of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead to
        the detrimental or unfavorable treatment of certain data subjects, or groups
        of data subjects, in social contexts that is:

        (1) Are unrelated to the contexts in which the data was originally generated
        or collected; and/or

        (2) Is unjustified or disproportionate to their social behavior or its gravity.'
      annotation: 'Does the organization prohibit the sale, deployment and/or use
        of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that lead
        to the detrimental or unfavorable treatment of certain data subjects, or groups
        of data subjects, in social contexts that is:

        (1) Are unrelated to the contexts in which the data was originally generated
        or collected; and/or

        (2) Is unjustified or disproportionate to their social behavior or its gravity?'
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.5
      name: Risk and Criminal Profiling
      description: 'Mechanisms exist to prohibit the sale, deployment and/or use of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:

        (1) Assess the risk of an individual committing a criminal offence; and

        (2) Predicts risk based solely on the profiling of personality traits and
        characteristics.'
      annotation: 'Does the organization prohibit the sale, deployment and/or use
        of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that:

        (1) Assess the risk of an individual committing a criminal offence; and

        (2) Predicts risk based solely on the profiling of personality traits and
        characteristics?'
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.6
      name: Populating Facial Recognition Databases
      description: "Mechanisms exist to prohibit the sale, deployment and/or use of\
        \ Artificial Intelligence (AI) and Autonomous Technologies (AAT) that create,\
        \ or expand, facial recognition databases through scraping facial images from:\n\
        (1) The Internet; or \n(2) Closed-Circuit Television (CCTV) footage."
      annotation: "Does the organization prohibit the sale, deployment and/or use\
        \ of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that create,\
        \ or expand, facial recognition databases through scraping facial images from:\n\
        (1) The Internet; or \n(2) Closed-Circuit Television (CCTV) footage?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.7
      name: Emotion Inference
      description: Mechanisms exist to prohibit the sale, deployment and/or use of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that infer
        human emotions of an individual based on observed characteristics.
      annotation: Does the organization prohibit the sale, deployment and/or use of
        Artificial Intelligence (AI) and Autonomous Technologies (AAT) that infer
        human emotions of an individual based on observed characteristics?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-19.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-19.8
      name: Biometric Categorization
      description: "Mechanisms exist to prohibit the sale, deployment and/or use of\
        \ Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize\
        \ an individual based on their biometric data to deduce, or infer, the individual's:\n\
        (1) Race; \n(2) Political opinions;\n(3) Trade union membership;\n(4) Religious\
        \ or philosophical beliefs; \n(5) Sex life or sexual orientation; and/or\n\
        (6) Age."
      annotation: "Does the organization prohibit the sale, deployment and/or use\
        \ of Artificial Intelligence (AI) and Autonomous Technologies (AAT) that categorize\
        \ an individual based on their biometric data to deduce, or infer, the individual's:\n\
        (1) Race; \n(2) Political opinions;\n(3) Trade union membership;\n(4) Religious\
        \ or philosophical beliefs; \n(5) Sex life or sexual orientation; and/or\n\
        (6) Age?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-20
      name: AI & Autonomous Technologies Development Practices
      description: "Measures exist to ensure Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) are designed and developed to:\n(1) Achieve an appropriate\
        \ level of accuracy, robustness, and cybersecurity; \n(2) Perform consistently\
        \ in those respects throughout the AAT system's lifecycle; and\n(3) Be effectively\
        \ overseen by competent individuals."
      annotation: "Does the organization ensure Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) are designed and developed to:\n(1) Achieve an appropriate\
        \ level of accuracy, robustness, and cybersecurity; \n(2) Perform consistently\
        \ in those respects throughout the AAT system's lifecycle; and\n(3) Be effectively\
        \ overseen by competent individuals?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-20.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-20.1
      name: AI & Autonomous Technologies Transparency
      description: Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) are designed and developed so its operation is sufficiently
        transparent such that output can be easily interpreted by personnel implementing
        the AAT.
      annotation: Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) are designed and developed so its operation is sufficiently
        transparent such that output can be easily interpreted by personnel implementing
        the AAT?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-20.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-20.2
      name: AI & Autonomous Technologies Implementation Documentation
      description: "Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) include clear and concise documentation that is relevant,\
        \ accessible and comprehensible to personnel implementing and maintaining\
        \ the AAT that, at a minimum, provides: \n(1) Contact details of the provider;\
        \ \n(2) Characteristics, capabilities and limitations of performance of the\
        \ AAT;\n(3) Errata from the AAT's initial conformity assessment;\n(4) Details\
        \ necessary to interpret the outputs of the AAT;\n(5) Human oversight measures\
        \ necessary to facilitate the interpretation of the outputs of the AAT;\n\
        (6) Computational and hardware resources needed to operate the AAT;\n(7) Projected\
        \ useable lifetime of the AAT; and\n(8) A description of the mechanisms included\
        \ within the AAT system to properly collect, store and interpret event logs."
      annotation: "Does the organization ensure Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) include clear and concise documentation that is relevant,\
        \ accessible and comprehensible to personnel implementing and maintaining\
        \ the AAT that, at a minimum, provides: \n(1) Contact details of the provider;\
        \ \n(2) Characteristics, capabilities and limitations of performance of the\
        \ AAT;\n(3) Errata from the AAT's initial conformity assessment;\n(4) Details\
        \ necessary to interpret the outputs of the AAT;\n(5) Human oversight measures\
        \ necessary to facilitate the interpretation of the outputs of the AAT;\n\
        (6) Computational and hardware resources needed to operate the AAT;\n(7) Projected\
        \ useable lifetime of the AAT; and\n(8) A description of the mechanisms included\
        \ within the AAT system to properly collect, store and interpret event logs?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-20.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-20.3
      name: AI & Autonomous Technologies Human Domain Knowledge Reliance
      description: 'Mechanisms exist to document the extent to which human domain
        knowledge is employed to improve Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) performance including:

        (1) Reinforcement Learning from Human Feedback (RLHF);

        (2) Fine-tuning;

        (3) Retrieval- augmented generation;

        (4) Content moderation; and

        (5) Business rules.'
      annotation: 'Does the organization document the extent to which human domain
        knowledge is employed to improve Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) performance including:

        (1) Reinforcement Learning from Human Feedback (RLHF);

        (2) Fine-tuning;

        (3) Retrieval- augmented generation;

        (4) Content moderation; and

        (5) Business rules?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-21
      name: AI & Autonomous Technologies Registration
      description: Mechanisms exist to maintain a current registration for Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing
        body, as required by statutory or regulatory requirements.
      annotation: Does the organization maintain a current registration for Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) with the appropriate governing
        body, as required by statutory or regulatory requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22
      name: AI & Autonomous Technologies Deployment
      description: Mechanisms exist to ensure the deployment of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) includes appropriate technical and
        organizational measures so that AAT are used in accordance with the AAT developer-provided
        instructions for use.
      annotation: Does the organization ensure the deployment of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) includes appropriate technical and
        organizational measures so that AAT are used in accordance with the AAT developer-provided
        instructions for use?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.1
      name: AI & Autonomous Technologies Human Oversight
      description: "Mechanisms exist to assign human oversight of Artificial Intelligence\
        \ (AI) and Autonomous Technologies (AAT) to prevent or minimize the risks\
        \ to:\n(1) Health; \n(2) Safety; and/or \n(3) Fundamental rights."
      annotation: "Does the organization assign human oversight of Artificial Intelligence\
        \ (AI) and Autonomous Technologies (AAT) to prevent or minimize the risks\
        \ to:\n(1) Health; \n(2) Safety; and/or \n(3) Fundamental rights?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.2
      name: AI & Autonomous Technologies Oversight Measures
      description: "Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) oversight measures are commensurate with the:\n(1) Assessed\
        \ risk(s); \n(2) Level of autonomy; and \n(3) Context of use."
      annotation: "Does the organization ensure Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) oversight measures are commensurate with the:\n(1) Assessed\
        \ risk(s); \n(2) Level of autonomy; and \n(3) Context of use?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.3
      name: AI & Autonomous Technologies Separate Verification
      description: Mechanisms exist to ensure no action or decision is taken by the
        deployer of an Artificial Intelligence (AI) and Autonomous Technologies (AAT)
        based solely based on AAT-generated evidence, unless that evidence has been
        separately verified and confirmed by at least two (2) individuals with the
        necessary competence, training and authority.
      annotation: Does the organization ensure no action or decision is taken by the
        deployer of an Artificial Intelligence (AI) and Autonomous Technologies (AAT)
        based solely based on AAT-generated evidence, unless that evidence has been
        separately verified and confirmed by at least two (2) individuals with the
        necessary competence, training and authority?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.4
      name: AI & Autonomous Technologies Oversight Functions Competency
      description: 'Mechanisms exist to ensure the deployment of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) assigns human oversight to individuals
        who have the necessary:

        (1) Competence;

        (2) Training;

        (3) Authority; and

        (4) Resources.'
      annotation: 'Does the organization ensure the deployment of Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) assigns human oversight to individuals
        who have the necessary:

        (1) Competence;

        (2) Training;

        (3) Authority; and

        (4) Resources?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.5
      name: AI & Autonomous Technologies Data Relevance
      description: Mechanisms exist to ensure the input to Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) is relevant to the intended purpose
        of the AAT.
      annotation: Does the organization ensure the input to Artificial Intelligence
        (AI) and Autonomous Technologies (AAT) is relevant to the intended purpose
        of the AAT?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.6
      name: AI & Autonomous Technologies Irregularity Reporting
      description: 'Mechanisms exist to ensure serious incidents and/or irregularities
        associated with the deployment of Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) are reported without delay to the:

        (1) AAT provider;

        (2) AAT importer or distributor, if applicable; and/or

        (3) Local law authorities and/or governmental agency, as required.'
      annotation: 'Does the organization ensure serious incidents and/or irregularities
        associated with the deployment of Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) are reported without delay to the:

        (1) AAT provider;

        (2) AAT importer or distributor, if applicable; and/or

        (3) Local law authorities and/or governmental agency, as required?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.7
      name: AI & Autonomous Technologies Use Notification To Employees
      description: Mechanisms exist to ensure employees, including workers' representatives,
        are informed about Artificial Intelligence (AI) and Autonomous Technologies
        (AAT) deployments, prior to the use of the AAT in a production environment.
      annotation: Does the organization ensure employees, including workers' representatives,
        are informed about Artificial Intelligence (AI) and Autonomous Technologies
        (AAT) deployments, prior to the use of the AAT in a production environment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-22.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-22.8
      name: AI & Autonomous Technologies Use Notification To Users
      description: 'Mechanisms exist to ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) that make decisions, or assist in making decisions, inform
        the people in a clear manner that they are:

        (1) Utilizing an AAT solution; and

        (2) Expected to validate the output for relevance and accuracy.'
      annotation: 'Does the organization ensure Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) that make decisions, or assist in making decisions, inform
        the people in a clear manner that they are:

        (1) Utilizing an AAT solution; and

        (2) Expected to validate the output for relevance and accuracy?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-23
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-23
      name: AI & Autonomous Technologies Output Marking
      description: Mechanisms exist to mark output from Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) in a machine-readable format so it is detectable
        as artificially generated or manipulated.
      annotation: Does the organization mark output from Artificial Intelligence (AI)
        and Autonomous Technologies (AAT) in a machine-readable format so it is detectable
        as artificially generated or manipulated?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-24
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-24
      name: Real World Testing of AI & Autonomous Technologies
      description: 'Mechanisms exist to obtain consent from the subjects of testing
        Artificial Intelligence (AI) and Autonomous Technologies (AAT):

        (1) Prior to their participation in such testing; and

        (2) After their having been provided with clear and concise information regarding
        the testing.'
      annotation: 'Does the organization obtain consent from the subjects of testing
        Artificial Intelligence (AI) and Autonomous Technologies (AAT):

        (1) Prior to their participation in such testing; and

        (2) After their having been provided with clear and concise information regarding
        the testing?'
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-25
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-25
      name: AI & Autonomous Technologies System Value Chain
      description: Mechanisms exist to document the sequence of events and relevant
        stakeholders involved in creating and deploying Artificial Intelligence (AI)
        and Autonomous Technologies (AAT).
      annotation: Does the organization document the sequence of events and relevant
        stakeholders involved in creating and deploying Artificial Intelligence (AI)
        and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-25.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-25.1
      name: AI & Autonomous Technologies System Value Chain Fallbacks
      description: 'Mechanisms exist to identify:

        (1) Over-reliance on third-party data with Artificial Intelligence (AI) and
        Autonomous Technologies (AAT); and

        (2) Fallback methods to address the inability to access third-party data,
        as necessary.'
      annotation: 'Does the organization identify:

        (1) Over-reliance on third-party data with Artificial Intelligence (AI) and
        Autonomous Technologies (AAT); and

        (2) Fallback methods to address the inability to access third-party data,
        as necessary?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-26
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-26
      name: AI & Autonomous Technologies Testing Techniques
      description: Mechanisms exist to develop and implement fact-checking techniques
        to verify the accuracy and veracity of information generated by Artificial
        Intelligence (AI) and Autonomous Technologies (AAT).
      annotation: Does the organization develop and implement fact-checking techniques
        to verify the accuracy and veracity of information generated by Artificial
        Intelligence (AI) and Autonomous Technologies (AAT)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-26.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-26.1
      name: Generative Artificial Intelligence (GAI) Identification
      description: Mechanisms exist to develop and implement testing techniques to
        identify Generative Artificial Intelligence (GAI) produced content (e.g.,
        synthetic media).
      annotation: Does the organization develop and implement testing techniques to
        identify Generative Artificial Intelligence (GAI) produced content (e.g.,
        synthetic media)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-26.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-26.2
      name: AI & Autonomous Technologies Capabilities Testing
      description: "Mechanisms exist to delineate human pro\uFB01ciency tests from\
        \ tests of Artificial Intelligence (AI) and Autonomous Technologies (AAT)\
        \ capabilities."
      annotation: "Does the organization delineate human pro\uFB01ciency tests from\
        \ tests of Artificial Intelligence (AI) and Autonomous Technologies (AAT)\
        \ capabilities?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-26.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-26.3
      name: Real-World Testing
      description: "Mechanisms exist to include relevant end-users, practitioners\
        \ and operators in Artificial Intelligence (AI) and Autonomous Technologies\
        \ (AAT) prototyping and testing activities to cover:\n(1) Applicable use case\
        \ scenarios;\n(2) Crisis situations; and/or \n(3) Ethically sensitive contexts."
      annotation: "Does the organization include relevant end-users, practitioners\
        \ and operators in Artificial Intelligence (AI) and Autonomous Technologies\
        \ (AAT) prototyping and testing activities to cover:\n(1) Applicable use case\
        \ scenarios;\n(2) Crisis situations; and/or \n(3) Ethically sensitive contexts?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-26.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-26.4
      name: Documenting Testing Guidance
      description: "Mechanisms exist to document the instructions given to:\n(1) Data\
        \ annotators; and/or \n(2) Artificial Intelligence (AI) and Autonomous Technologies\
        \ (AAT) red-teamers."
      annotation: "Does the organization document the instructions given to:\n(1)\
        \ Data annotators; and/or \n(2) Artificial Intelligence (AI) and Autonomous\
        \ Technologies (AAT) red-teamers?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-27
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-27
      name: AI & Autonomous Technologies Output Filtering
      description: 'Mechanisms exist to prevent Artificial Intelligence (AI) and Autonomous
        Technologies (AAT) from generating content that is:

        (1) Inappropriate;

        (2) Harmful;

        (3) False;

        (4) Illegal; and/or

        (5) Violent.'
      annotation: 'Does the organization prevent Artificial Intelligence (AI) and
        Autonomous Technologies (AAT) from generating content that is:

        (1) Inappropriate;

        (2) Harmful;

        (3) False;

        (4) Illegal; and/or

        (5) Violent?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat-27.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:aat
      ref_id: AAT-27.1
      name: Human Moderation
      description: Mechanisms exist to assign personnel to review Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-generated content for alignment with
        culturally accepted norms.
      annotation: Does the organization assign personnel to review Artificial Intelligence
        (AI) and Autonomous Technologies (AAT)-generated content for alignment with
        culturally accepted norms?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      assessable: false
      depth: 1
      ref_id: AST
      name: Asset Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-01
      name: Asset Governance
      description: Mechanisms exist to facilitate an IT Asset Management (ITAM) program
        to implement and manage asset management controls.
      annotation: Does the organization facilitate an IT Asset Management (ITAM) program
        to implement and manage asset management controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-01.1
      name: Asset-Service Dependencies
      description: Mechanisms exist to identify and assess the security of technology
        assets that support more than one critical business function.
      annotation: Does the organization identify and assess the security of technology
        assets that support more than one critical business function?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-01.2
      name: Stakeholder Identification & Involvement
      description: Mechanisms exist to identify and involve pertinent stakeholders
        of critical systems, applications and services to support the ongoing secure
        management of those assets.
      annotation: Does the organization identify and involve pertinent stakeholders
        of critical systems, applications and services to support the ongoing secure
        management of those assets?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-01.3
      name: Standardized Naming Convention
      description: Mechanisms exist to implement a scalable, standardized naming convention
        for systems, applications and services that avoids asset naming conflicts.
      annotation: Does the organization implement a scalable, standardized naming
        convention for systems, applications and services that avoids asset naming
        conflicts?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-01.4
      name: Approved Technologies
      description: Mechanisms exist to maintain a current list of approved technologies
        (hardware and software).
      annotation: Does the organization maintain a current list of approved technologies
        (hardware and software)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02
      name: Asset Inventories
      description: "Mechanisms exist to perform inventories of technology assets that:\n\
        (1) Accurately reflects the current systems, applications and services in\
        \ use; \n(2) Identifies authorized software products, including business justification\
        \ details;\n(3) Is at the level of granularity deemed necessary for tracking\
        \ and reporting;\n(4) Includes organization-defined information deemed necessary\
        \ to achieve effective property accountability; and\n(5) Is available for\
        \ review and audit by designated organizational personnel."
      annotation: "Does the organization perform inventories of technology assets\
        \ that:\n (1) Accurately reflects the current systems, applications and services\
        \ in use; \n (2) Identifies authorized software products, including business\
        \ justification details;\n (3) Is at the level of granularity deemed necessary\
        \ for tracking and reporting;\n (4) Includes organization-defined information\
        \ deemed necessary to achieve effective property accountability; and\n (5)\
        \ Is available for review and audit by designated organizational personnel?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.1
      name: Updates During Installations / Removals
      description: Mechanisms exist to update asset inventories as part of component
        installations, removals and asset upgrades.
      annotation: Does the organization update asset inventories as part of component
        installations, removals and asset upgrades?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.2
      name: Automated Unauthorized Component Detection
      description: Automated mechanisms exist to detect and alert upon the detection
        of unauthorized hardware, software and firmware components.
      annotation: Does the organization use automated mechanisms to detect and alert
        upon the detection of unauthorized hardware, software and firmware components?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.3
      name: Component Duplication Avoidance
      description: Mechanisms exist to establish and maintain an authoritative source
        and repository to provide a trusted source and accountability for approved
        and implemented system components that prevents assets from being duplicated
        in other asset inventories.
      annotation: Does the organization establish and maintain an authoritative source
        and repository to provide a trusted source and accountability for approved
        and implemented system components that prevents assets from being duplicated
        in other asset inventories?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.4
      name: Approved Baseline Deviations
      description: Mechanisms exist to document and govern instances of approved deviations
        from established baseline configurations.
      annotation: Does the organization document and govern instances of approved
        deviations from established baseline configurations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.5
      name: Network Access Control (NAC)
      description: Automated mechanisms exist to employ Network Access Control (NAC),
        or a similar technology, which is capable of detecting unauthorized devices
        and disable network access to those unauthorized devices.
      annotation: Does the organization use automated mechanisms to employ Network
        Access Control (NAC), or a similar technology, which is capable of detecting
        unauthorized devices and disable network access to those unauthorized devices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.6
      name: Dynamic Host Configuration Protocol (DHCP) Server Logging
      description: Mechanisms exist to enable Dynamic Host Configuration Protocol
        (DHCP) server logging to improve asset inventories and assist in detecting
        unknown systems.
      annotation: Does the organization enable Dynamic Host Configuration Protocol
        (DHCP) server logging to improve asset inventories and assist in detecting
        unknown systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.7
      name: Software Licensing Restrictions
      description: Mechanisms exist to protect Intellectual Property (IP) rights with
        software licensing restrictions.
      annotation: Does the organization protect Intellectual Property (IP) rights
        with software licensing restrictions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.8
      name: Data Action Mapping
      description: Mechanisms exist to create and maintain a map of technology assets
        where sensitive/regulated data is stored, transmitted or processed.
      annotation: Does the organization create and maintain a map of technology assets
        where sensitive/regulated data is stored, transmitted or processed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.9
      name: Configuration Management Database (CMDB)
      description: Mechanisms exist to implement and manage a Configuration Management
        Database (CMDB), or similar technology, to monitor and govern technology asset-specific
        information.
      annotation: Does the organization implement and manage a Configuration Management
        Database (CMDB), or similar technology, to monitor and govern technology asset-specific
        information?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.10
      name: 'Automated Location

        Tracking'
      description: Mechanisms exist to track the geographic location of system components.
      annotation: Does the organization track the geographic location of system components?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-02.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-02.11
      name: Component Assignment
      description: Mechanisms exist to bind components to a specific system.
      annotation: Does the organization bind components to a specific system?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-03
      name: Asset Ownership Assignment
      description: Mechanisms exist to ensure asset ownership responsibilities are
        assigned, tracked and managed at a team, individual, or responsible organization
        level to establish a common understanding of requirements for asset protection.
      annotation: Does the organization ensure asset ownership responsibilities are
        assigned, tracked and managed at a team, individual, or responsible organization
        level to establish a common understanding of requirements for asset protection?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-03.1
      name: Accountability Information
      description: Mechanisms exist to include capturing the name, position and/or
        role of individuals responsible/accountable for administering assets as part
        of the technology asset inventory process.
      annotation: Does the organization include capturing the name, position and/or
        role of individuals responsible/accountable for administering assets as part
        of the technology asset inventory process?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-03.2
      name: Provenance
      description: Mechanisms exist to track the origin, development, ownership, location
        and changes to systems, system components and associated data.
      annotation: Does the organization track the origin, development, ownership,
        location and changes to systems, system components and associated data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-04
      name: Network Diagrams & Data Flow Diagrams (DFDs)
      description: "Mechanisms exist to maintain network architecture diagrams that:\
        \ \n(1) Contain sufficient detail to assess the security of the network's\
        \ architecture;\n(2) Reflect the current architecture of the network environment;\
        \ and\n(3) Document all sensitive/regulated data flows."
      annotation: "Does the organization maintain network architecture diagrams that:\
        \ \n (1) Contain sufficient detail to assess the security of the network's\
        \ architecture;\n (2) Reflect the current architecture of the network environment;\
        \ and\n (3) Document all sensitive/regulated data flows?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-04.1
      name: Asset Scope Classification
      description: Mechanisms exist to determine cybersecurity & data privacy control
        applicability by identifying, assigning and documenting the appropriate asset
        scope categorization for all systems, applications, services and personnel
        (internal and third-parties).
      annotation: Does the organization determine cybersecurity & data privacy control
        applicability by identifying, assigning and documenting the appropriate asset
        scope categorization for all systems, applications, services and personnel
        (internal and third-parties)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-04.2
      name: Control Applicability Boundary Graphical Representation
      description: Mechanisms exist to ensure control applicability is appropriately-determined
        for systems, applications, services and third parties by graphically representing
        applicable boundaries.
      annotation: Does the organization ensure control applicability is appropriately-determined
        for systems, applications, services and third parties by graphically representing
        applicable boundaries?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-04.3
      name: Compliance-Specific Asset Identification
      description: Mechanisms exist to create and maintain a current inventory of
        systems, applications and services that are in scope for statutory, regulatory
        and/or contractual compliance obligations that provides sufficient detail
        to determine control applicability, based on asset scope categorization.
      annotation: Does the organization create and maintain a current inventory of
        systems, applications and services that are in scope for statutory, regulatory
        and/or contractual compliance obligations that provides sufficient detail
        to determine control applicability, based on asset scope categorization?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-05
      name: Security of Assets & Media
      description: Mechanisms exist to maintain strict control over the internal or
        external distribution of any kind of sensitive/regulated media.
      annotation: Does the organization maintain strict control over the internal
        or external distribution of any kind of sensitive/regulated media?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-05.1
      name: Management Approval For External Media Transfer
      description: Mechanisms exist to obtain management approval for any sensitive
        / regulated media that is transferred outside of the organization's facilities.
      annotation: Does the organization obtain management approval for any sensitive
        / regulated media that is transferred outside of its facilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-06
      name: Unattended End-User Equipment
      description: Mechanisms exist to implement enhanced protection measures for
        unattended systems to protect against tampering and unauthorized access.
      annotation: Does the organization implement enhanced protection measures for
        unattended systems to protect against tampering and unauthorized access?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-06.1
      name: Asset Storage In Automobiles
      description: Mechanisms exist to educate users on the need to physically secure
        laptops and other mobile devices out of sight when traveling, preferably in
        the trunk of a vehicle.
      annotation: Does the organization educate users on the need to physically secure
        laptops and other mobile devices out of sight when traveling, preferably in
        the trunk of a vehicle?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-07
      name: Kiosks & Point of Interaction (PoI) Devices
      description: Mechanisms exist to appropriately protect devices that capture
        sensitive/regulated data via direct physical interaction from tampering and
        substitution.
      annotation: Does the organization appropriately protect devices that capture
        sensitive/regulated data via direct physical interaction from tampering and
        substitution?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-08
      name: Physical Tampering Detection
      description: Mechanisms exist to periodically inspect systems and system components
        for Indicators of Compromise (IoC).
      annotation: Does the organization periodically inspect systems and system components
        for Indicators of Compromise (IoC)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-09
      name: Secure Disposal, Destruction or Re-Use of Equipment
      description: Mechanisms exist to securely dispose of, destroy or repurpose system
        components using organization-defined techniques and methods to prevent information
        being recovered from these components.
      annotation: Does the organization securely dispose of, destroy or repurpose
        system components using organization-defined techniques and methods to prevent
        information being recovered from these components?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-10
      name: Return of Assets
      description: Mechanisms exist to ensure that employees and third-party users
        return all organizational assets in their possession upon termination of employment,
        contract or agreement.
      annotation: Does the organization ensure that employees and third-party users
        return all organizational assets in their possession upon termination of employment,
        contract or agreement?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-11
      name: Removal of Assets
      description: Mechanisms exist to authorize, control and track technology assets
        entering and exiting organizational facilities.
      annotation: Does the organization authorize, control and track technology assets
        entering and exiting organizational facilities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-12
      name: Use of Personal Devices
      description: Mechanisms exist to restrict the possession and usage of personally-owned
        technology devices within organization-controlled facilities.
      annotation: Does the organization restrict the possession and usage of personally-owned
        technology devices within organization-controlled facilities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-13
      name: Use of Third-Party Devices
      description: Mechanisms exist to reduce the risk associated with third-party
        assets that are attached to the network from harming organizational assets
        or exfiltrating organizational data.
      annotation: Does the organization reduce the risk associated with third-party
        assets that are attached to the network from harming organizational assets
        or exfiltrating organizational data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-14
      name: Usage Parameters
      description: Mechanisms exist to monitor and enforce usage parameters that limit
        the potential damage caused from the unauthorized or unintentional alteration
        of system parameters.
      annotation: Does the organization monitor and enforce usage parameters that
        limit the potential damage caused from the unauthorized or unintentional alteration
        of system parameters?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-14.1
      name: Bluetooth & Wireless Devices
      description: Mechanisms exist to prevent the usage of Bluetooth and wireless
        devices (e.g., Near Field Communications (NFC)) in sensitive areas or unless
        used in a Radio Frequency (RF)-screened building.
      annotation: Does the organization prevent the usage of Bluetooth and wireless
        devices (e.g., Near Field Communications (NFC)) in sensitive areas or unless
        used in a Radio Frequency (RF)-screened building?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-14.2
      name: Infrared Communications
      description: Mechanisms exist to prevent line of sight and reflected infrared
        (IR) communications use in an unsecured space.
      annotation: Does the organization prevent line of sight and reflected infrared
        (IR) communications use in an unsecured space?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-15
      name: Logical Tampering Protection
      description: Mechanisms exist to verify logical configuration settings and the
        physical integrity of critical technology assets throughout their lifecycle.
      annotation: Does the organization verify logical configuration settings and
        the physical integrity of critical technology assets throughout their lifecycle?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-15.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-15.1
      name: Inspection of Systems, Components & Devices
      description: Mechanisms exist to physically and logically inspect critical technology
        assets to detect evidence of tampering.
      annotation: Does the organization physically and logically inspect critical
        technology assets to detect evidence of tampering?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-16
      name: Bring Your Own Device (BYOD) Usage
      description: Mechanisms exist to implement and govern a Bring Your Own Device
        (BYOD) program to reduce risk associated with personally-owned devices in
        the workplace.
      annotation: Does the organization implement and govern a Bring Your Own Device
        (BYOD) program to reduce risk associated with personally-owned devices in
        the workplace?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-17
      name: Prohibited Equipment & Services
      description: Mechanisms exist to govern Supply Chain Risk Management (SCRM)
        sanctions that require the removal and prohibition of certain technology services
        and/or equipment that are designated as supply chain threats by a statutory
        or regulatory body.
      annotation: Does the organization govern Supply Chain Risk Management (SCRM)
        sanctions that require the removal and prohibition of certain technology services
        and/or equipment that are designated as supply chain threats by a statutory
        or regulatory body?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-18
      name: Roots of Trust Protection
      description: "Mechanisms exist to provision and protect the confidentiality,\
        \ integrity and authenticity of product supplier keys and data that can be\
        \ used as a \u201Croots of trust\u201D basis for integrity verification."
      annotation: "Does the organization provision and protect the confidentiality,\
        \ integrity and authenticity of product supplier keys and data that can be\
        \ used as a \u201Croots of trust\u201D basis for integrity verification?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-19
      name: Telecommunications Equipment
      description: Mechanisms exist to establish usage restrictions and implementation
        guidance for telecommunication equipment to prevent potential damage or unauthorized
        modification and to prevent potential eavesdropping.
      annotation: Does the organization establish usage restrictions and implementation
        guidance for telecommunication equipment to prevent potential damage or unauthorized
        modification and to prevent potential eavesdropping?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-20
      name: Video Teleconference (VTC) Security
      description: Mechanisms exist to implement secure Video Teleconference (VTC)
        capabilities on endpoint devices and in designated conference rooms, to prevent
        potential eavesdropping.
      annotation: Does the organization implement secure Video Teleconference (VTC)
        capabilities on endpoint devices and in designated conference rooms, to prevent
        potential eavesdropping?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-21
      name: Voice Over Internet Protocol (VoIP) Security
      description: Mechanisms exist to implement secure Internet Protocol Telephony
        (IPT) that logically or physically separates Voice Over Internet Protocol
        (VoIP) traffic from data networks.
      annotation: Does the organization implement secure Internet Protocol Telephony
        (IPT) that logically or physically separates Voice Over Internet Protocol
        (VoIP) traffic from data networks?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-22
      name: Microphones & Web Cameras
      description: Mechanisms exist to configure assets to prohibit the use of endpoint-based
        microphones and web cameras in secure areas or where sensitive/regulated information
        is discussed.
      annotation: Does the organization configure assets to prohibit the use of endpoint-based
        microphones and web cameras in secure areas or where sensitive/regulated information
        is discussed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-23
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-23
      name: Multi-Function Devices (MFD)
      description: Mechanisms exist to securely configure Multi-Function Devices (MFD)
        according to industry-recognized secure practices for the type of device.
      annotation: Does the organization securely configure Multi-Function Devices
        (MFD) according to industry-recognized secure practices for the type of device?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-24
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-24
      name: Travel-Only Devices
      description: Mechanisms exist to issue personnel travelling overseas with temporary,
        loaner or "travel-only" end user technology (e.g., laptops and mobile devices)
        when travelling to authoritarian countries with a higher-than average risk
        for Intellectual Property (IP) theft or espionage against individuals and
        private companies.
      annotation: Does the organization issue personnel travelling overseas with temporary,
        loaner or "travel-only" end user technology (e.g., laptops and mobile devices)
        when travelling to authoritarian countries with a higher-than average risk
        for Intellectual Property (IP) theft or espionage against individuals and
        private companies?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-25
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-25
      name: Re-Imaging Devices After Travel
      description: Mechanisms exist to re-image end user technology (e.g., laptops
        and mobile devices) when returning from overseas travel to an authoritarian
        country with a higher-than average risk for Intellectual Property (IP) theft
        or espionage against individuals and private companies.
      annotation: Does the organization re-image end user technology (e.g., laptops
        and mobile devices) when returning from overseas travel to an authoritarian
        country with a higher-than average risk for Intellectual Property (IP) theft
        or espionage against individuals and private companies?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-26
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-26
      name: System Administrative Processes
      description: Mechanisms exist to develop, implement and govern system administration
        processes, with corresponding Standardized Operating Procedures (SOP), for
        operating and maintaining systems, applications and services.
      annotation: Does the organization develop, implement and govern system administration
        processes, with corresponding Standardized Operating Procedures (SOP), for
        operating and maintaining systems, applications and services?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-27
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-27
      name: Jump Server
      description: Mechanisms exist to conduct remote system administrative functions
        via a "jump box" or "jump server" that is located in a separate network zone
        to user workstations.
      annotation: Does the organization conduct remote system administrative functions
        via a "jump box" or "jump server" that is located in a separate network zone
        to user workstations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-28
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-28
      name: Database Administrative Processes
      description: Mechanisms exist to develop, implement and govern database management
        processes, with corresponding Standardized Operating Procedures (SOP), for
        operating and maintaining databases.
      annotation: Does the organization develop, implement and govern database management
        processes, with corresponding Standardized Operating Procedures (SOP), for
        operating and maintaining databases?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-28.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-28.1
      name: Database Management System (DBMS)
      description: Mechanisms exist to implement and maintain Database Management
        Systems (DBMSs), where applicable.
      annotation: Does the organization implement and maintain Database Management
        Systems (DBMSs), where applicable?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-29
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-29
      name: Radio Frequency Identification (RFID) Security
      description: Mechanisms exist to securely govern Radio Frequency Identification
        (RFID) deployments to ensure RFID is used safely and securely to protect the
        confidentiality and integrity of data and prevent the compromise of secure
        spaces.
      annotation: Does the organization securely govern Radio Frequency Identification
        (RFID) deployments to ensure RFID is used safely and securely to protect the
        confidentiality and integrity of data and prevent the compromise of secure
        spaces?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-29.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-29.1
      name: Contactless Access Control Systems
      description: Mechanisms exist to securely configure contactless access control
        systems incorporating contactless RFID or smart cards to protect the confidentiality
        and integrity of data and prevent the compromise of secure spaces.
      annotation: Does the organization securely configure contactless access control
        systems incorporating contactless RFID or smart cards to protect the confidentiality
        and integrity of data and prevent the compromise of secure spaces?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-30
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-30
      name: Decommissioning
      description: Mechanisms exist to ensure systems, applications and services are
        properly decommissioned so that data is properly transitioned to new systems
        or archived in accordance with applicable organizational standards, as well
        as statutory, regulatory and contractual obligations.
      annotation: Does the organization ensure systems, applications and services
        are properly decommissioned so that data is properly transitioned to new systems
        or archived in accordance with applicable organizational standards, as well
        as statutory, regulatory and contractual obligations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-31
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-31
      name: Asset Categorization
      description: Mechanisms exist to categorize technology assets.
      annotation: Does the organization categorize technology assets?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-31.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-31.1
      name: Categorize Artificial Intelligence (AI)-Related Technologies
      description: Mechanisms exist to categorize Artificial Intelligence (AI) and
        Autonomous Technologies (AAT).
      annotation: Does the organization categorize Artificial Intelligence (AI) and
        Autonomous Technologies (AAT)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast-31.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ast
      ref_id: AST-31.2
      name: High-Risk Asset Categorization
      description: "Mechanisms exist to categorize a system and/or service as \"High\
        \ Risk\" if it poses a significant risk of harm to an individual's:\n(1) Health;\n\
        (2) Safety; and/or \n(3) Fundamental human rights."
      annotation: "Does the organization categorize a system and/or service as \"\
        High Risk\" if it poses a significant risk of harm to an individual's:\n(1)\
        \ Health;\n(2) Safety; and/or \n(3) Fundamental human rights?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      assessable: false
      depth: 1
      ref_id: BCD
      name: Business Continuity & Disaster Recovery
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01
      name: Business Continuity Management System (BCMS)
      description: Mechanisms exist to facilitate the implementation of contingency
        planning controls to help ensure resilient assets and services (e.g., Continuity
        of Operations Plan (COOP) or Business Continuity & Disaster Recovery (BC/DR)
        playbooks).
      annotation: Does the organization facilitate the implementation of contingency
        planning controls to help ensure resilient assets and services (e.g., Continuity
        of Operations Plan (COOP) or Business Continuity & Disaster Recovery (BC/DR)
        playbooks)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01.1
      name: Coordinate with Related Plans
      description: Mechanisms exist to coordinate contingency plan development with
        internal and external elements responsible for related plans.
      annotation: Does the organization coordinate contingency plan development with
        internal and external elements responsible for related plans?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01.2
      name: Coordinate With External Service Providers
      description: Mechanisms exist to coordinate internal contingency plans with
        the contingency plans of external service providers to ensure that contingency
        requirements can be satisfied.
      annotation: Does the organization coordinate internal contingency plans with
        the contingency plans of external service providers to ensure that contingency
        requirements can be satisfied?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01.3
      name: Transfer to Alternate Processing / Storage Site
      description: Mechanisms exist to redeploy personnel to other roles during a
        disruptive event or in the execution of a continuity plan.
      annotation: Does the organization redeploy personnel to other roles during a
        disruptive event or in the execution of a continuity plan?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01.4
      name: Recovery Time / Point Objectives (RTO / RPO)
      description: Mechanisms exist to facilitate recovery operations in accordance
        with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
      annotation: Does the organization facilitate recovery operations in accordance
        with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01.5
      name: Recovery Operations Criteria
      description: Mechanisms exist to define specific criteria that must be met to
        initiate Business Continuity / Disaster Recover (BC/DR) plans that facilitate
        business continuity operations capable of meeting applicable Recovery Time
        Objectives (RTOs) and Recovery Point Objectives (RPOs).
      annotation: Does the organization define specific criteria that must be met
        to initiate Business Continuity / Disaster Recover (BC/DR) plans that facilitate
        business continuity operations capable of meeting applicable Recovery Time
        Objectives (RTOs) and Recovery Point Objectives (RPOs)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-01.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-01.6
      name: Recovery Operations Communications
      description: Mechanisms exist to communicate the status of recovery activities
        and progress in restoring operational capabilities to designated internal
        and external stakeholders.
      annotation: Does the organization communicate the status of recovery activities
        and progress in restoring operational capabilities to designated internal
        and external stakeholders?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-02
      name: Identify Critical Assets
      description: Mechanisms exist to identify and document the critical systems,
        applications and services that support essential missions and business functions.
      annotation: Does the organization identify and document the critical systems,
        applications and services that support essential missions and business functions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-02.1
      name: Resume All Missions & Business Functions
      description: Mechanisms exist to resume all missions and business functions
        within Recovery Time Objectives (RTOs) of the contingency plan's activation.
      annotation: Does the organization resume all missions and business functions
        within Recovery Time Objectives (RTOs) of the contingency plan's activation?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-02.2
      name: Continue Essential Mission & Business Functions
      description: Mechanisms exist to continue essential missions and business functions
        with little or no loss of operational continuity and sustain that continuity
        until full system restoration at primary processing and/or storage sites.
      annotation: Does the organization continue essential missions and business functions
        with little or no loss of operational continuity and sustain that continuity
        until full system restoration at primary processing and/or storage sites?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-02.3
      name: Resume Essential Missions & Business Functions
      description: Mechanisms exist to resume essential missions and business functions
        within an organization-defined time period of contingency plan activation.
      annotation: Does the organization resume essential missions and business functions
        within an organization-defined time period of contingency plan activation?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-02.4
      name: Data Storage Location Reviews
      description: Mechanisms exist to perform periodic security reviews of storage
        locations that contain sensitive / regulated data.
      annotation: Does the organization perform periodic security reviews of storage
        locations that contain sensitive / regulated data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-03
      name: Contingency Training
      description: Mechanisms exist to adequately train contingency personnel and
        applicable stakeholders in their contingency roles and responsibilities.
      annotation: Does the organization adequately train contingency personnel and
        applicable stakeholders in their contingency roles and responsibilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-03.1
      name: Simulated Events
      description: Mechanisms exist to incorporate simulated events into contingency
        training to facilitate effective response by personnel in crisis situations.
      annotation: Does the organization incorporate simulated events into contingency
        training to facilitate effective response by personnel in crisis situations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-03.2
      name: Automated Training Environments
      description: Automated mechanisms exist to provide a more thorough and realistic
        contingency training environment.
      annotation: Does the organization use automated mechanisms to provide a more
        thorough and realistic contingency training environment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-04
      name: Contingency Plan Testing & Exercises
      description: Mechanisms exist to conduct tests and/or exercises to evaluate
        the contingency plan's effectiveness and the organization's readiness to execute
        the plan.
      annotation: Does the organization conduct tests and/or exercises to evaluate
        the contingency plan's effectiveness and its readiness to execute the plan?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-04.1
      name: Coordinated Testing with Related Plans
      description: Mechanisms exist to coordinate contingency plan testing with internal
        and external elements responsible for related plans.
      annotation: Does the organization coordinate contingency plan testing with internal
        and external elements responsible for related plans?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-04.2
      name: Alternate Storage & Processing Sites
      description: Mechanisms exist to test contingency plans at alternate storage
        & processing sites to both familiarize contingency personnel with the facility
        and evaluate the capabilities of the alternate processing site to support
        contingency operations.
      annotation: Does the organization test contingency plans at alternate storage
        & processing sites to both familiarize contingency personnel with the facility
        and evaluate the capabilities of the alternate processing site to support
        contingency operations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-05
      name: Contingency Plan Root Cause Analysis (RCA) & Lessons Learned
      description: Mechanisms exist to conduct a Root Cause Analysis (RCA) and "lessons
        learned" activity every time the contingency plan is activated.
      annotation: Does the organization conduct a Root Cause Analysis (RCA) and "lessons
        learned" activity every time the contingency plan is activated?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-06
      name: Ongoing Contingency Planning
      description: 'Mechanisms exist to update contingency plans due to changes affecting:

        (1) People (e.g., personnel changes);

        (2) Processes (e.g., new, altered or decommissioned business practices, including
        third-party services)

        (3) Technologies (e.g., new, altered or decommissioned technologies);

        (4) Data (e.g., changes to data flows and/or data repositories);

        (5) Facilities (e.g., new, altered or decommissioned physical infrastructure);
        and/or

        (6) Feedback from contingency plan testing activities.'
      annotation: 'Does the organization update contingency plans due to changes affecting:

        (1) People (e.g., personnel changes);

        (2) Processes (e.g., new, altered or decommissioned business practices, including
        third-party services)

        (3) Technologies (e.g., new, altered or decommissioned technologies);

        (4) Data (e.g., changes to data flows and/or data repositories);

        (5) Facilities (e.g., new, altered or decommissioned physical infrastructure);
        and/or

        (6) Feedback from contingency plan testing activities?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-06.1
      name: Contingency Planning Components
      description: "Mechanisms exist to identify components that potentially impact\
        \ the organization's ability to execute contingency plans, including changes\
        \ to:\n(1) Personnel roles;\n(2) Business processes (including the use of\
        \ third-party services);\n(3) Deployed technologies; \n(4) Data repositories\
        \ and/or data flows; and/or\n(5) Physical infrastructure."
      annotation: "Does the organization identify components that potentially impact\
        \ the organization's ability to execute contingency plans, including changes\
        \ to:\n(1) Personnel roles;\n(2) Business processes (including the use of\
        \ third-party services);\n(3) Deployed technologies; \n(4) Data repositories\
        \ and/or data flows; and/or\n(5) Physical infrastructure?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-06.2
      name: Contingency Plan Update Notifications
      description: Mechanisms exist to keep stakeholders informed of changes to contingency
        plans.
      annotation: Does the organization keep stakeholders informed of changes to contingency
        plans?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-07
      name: Alternative Security Measures
      description: Mechanisms exist to implement alternative or compensating controls
        to satisfy security functions when the primary means of implementing the security
        function is unavailable or compromised.
      annotation: Does the organization implement alternative or compensating controls
        to satisfy security functions when the primary means of implementing the security
        function is unavailable or compromised?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-08
      name: Alternate Storage Site
      description: Mechanisms exist to establish an alternate storage site that includes
        both the assets and necessary agreements to permit the storage and recovery
        of system backup information.
      annotation: Does the organization establish an alternate storage site that includes
        both the assets and necessary agreements to permit the storage and recovery
        of system backup information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-08.1
      name: Separation from Primary Site
      description: Mechanisms exist to separate the alternate storage site from the
        primary storage site to reduce susceptibility to similar threats.
      annotation: Does the organization separate the alternate storage site from the
        primary storage site to reduce susceptibility to similar threats?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-08.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-08.2
      name: Accessibility
      description: Mechanisms exist to identify and mitigate potential accessibility
        problems to the alternate storage site in the event of an area-wide disruption
        or disaster.
      annotation: Does the organization identify and mitigate potential accessibility
        problems to the alternate storage site in the event of an area-wide disruption
        or disaster?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-09
      name: Alternate Processing Site
      description: Mechanisms exist to establish an alternate processing site that
        provides security measures equivalent to that of the primary site.
      annotation: Does the organization establish an alternate processing site that
        provides security measures equivalent to that of the primary site?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-09.1
      name: Separation from Primary Site
      description: Mechanisms exist to separate the alternate processing site from
        the primary processing site to reduce susceptibility to similar threats.
      annotation: Does the organization separate the alternate processing site from
        the primary processing site to reduce susceptibility to similar threats?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-09.2
      name: Accessibility
      description: Mechanisms exist to identify and mitigate potential accessibility
        problems to the alternate processing site and possible mitigation actions,
        in the event of an area-wide disruption or disaster.
      annotation: Does the organization identify and mitigate potential accessibility
        problems to the alternate processing site and possible mitigation actions,
        in the event of an area-wide disruption or disaster?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-09.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-09.3
      name: Alternate Site Priority of Service
      description: Mechanisms exist to address priority-of-service provisions in alternate
        processing and storage sites that support availability requirements, including
        Recovery Time Objectives (RTOs).
      annotation: Does the organization address priority-of-service provisions in
        alternate processing and storage sites that support availability requirements,
        including Recovery Time Objectives (RTOs)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-09.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-09.4
      name: Preparation for Use
      description: Mechanisms exist to prepare the alternate processing alternate
        to support essential missions and business functions so that the alternate
        site is capable of being used as the primary site.
      annotation: Does the organization prepare the alternate processing alternate
        to support essential missions and business functions so that the alternate
        site is capable of being used as the primary site?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-09.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-09.5
      name: Inability to Return to Primary Site
      description: Mechanisms exist to plan and prepare for both natural and manmade
        circumstances that preclude returning to the primary processing site.
      annotation: Does the organization plan and prepare for both natural and manmade
        circumstances that preclude returning to the primary processing site?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-10
      name: Telecommunications Services Availability
      description: Mechanisms exist to reduce the likelihood of a single point of
        failure with primary telecommunications services.
      annotation: Does the organization reduce the likelihood of a single point of
        failure with primary telecommunications services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-10.1
      name: Telecommunications Priority of Service Provisions
      description: Mechanisms exist to formalize primary and alternate telecommunications
        service agreements contain priority-of-service provisions that support availability
        requirements, including Recovery Time Objectives (RTOs).
      annotation: Does the organization formalize primary and alternate telecommunications
        service agreements contain priority-of-service provisions that support availability
        requirements, including Recovery Time Objectives (RTOs)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-10.2
      name: Separation of Primary / Alternate Providers
      description: Mechanisms exist to obtain alternate telecommunications services
        from providers that are separated from primary service providers to reduce
        susceptibility to the same threats.
      annotation: Does the organization obtain alternate telecommunications services
        from providers that are separated from primary service providers to reduce
        susceptibility to the same threats?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-10.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-10.3
      name: Provider Contingency Plan
      description: Mechanisms exist to contractually-require external service providers
        to have contingency plans that meet organizational contingency requirements.
      annotation: Does the organization contractually-require external service providers
        to have contingency plans that meet organizational contingency requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-10.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-10.4
      name: Alternate Communications Channels
      description: Mechanisms exist to maintain command and control capabilities via
        alternate communications channels and designating alternative decision makers
        if primary decision makers are unavailable.
      annotation: Does the organization maintain command and control capabilities
        via alternate communications channels and designating alternative decision
        makers if primary decision makers are unavailable?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11
      name: Data Backups
      description: Mechanisms exist to create recurring backups of data, software
        and/or system images, as well as verify the integrity of these backups, to
        ensure the availability of the data to satisfying Recovery Time Objectives
        (RTOs) and Recovery Point Objectives (RPOs).
      annotation: Does the organization create recurring backups of data, software
        and/or system images, as well as verify the integrity of these backups, to
        ensure the availability of the data to satisfying Recovery Time Objectives
        (RTOs) and Recovery Point Objectives (RPOs)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.1
      name: Testing for Reliability & Integrity
      description: Mechanisms exist to routinely test backups that verify the reliability
        of the backup process, as well as the integrity and availability of the data.
      annotation: Does the organization routinely test backups that verify the reliability
        of the backup process, as well as the integrity and availability of the data?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.2
      name: Separate Storage for Critical Information
      description: Mechanisms exist to store backup copies of critical software and
        other security-related information in a separate facility or in a fire-rated
        container that is not collocated with the system being backed up.
      annotation: Does the organization store backup copies of critical software and
        other security-related information in a separate facility or in a fire-rated
        container that is not collocated with the system being backed up?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.3
      name: Information System Imaging
      description: Mechanisms exist to reimage assets from configuration-controlled
        and integrity-protected images that represent a secure, operational state.
      annotation: Does the organization reimage assets from configuration-controlled
        and integrity-protected images that represent a secure, operational state?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.4
      name: Cryptographic Protection
      description: Cryptographic mechanisms exist to prevent the unauthorized disclosure
        and/or modification of backup information.
      annotation: Are cryptographic mechanisms utilized to prevent the unauthorized
        disclosure and/or modification of backup information?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.5
      name: Test Restoration Using Sampling
      description: Mechanisms exist to utilize sampling of available backups to test
        recovery capabilities as part of business continuity plan testing.
      annotation: Does the organization utilize sampling of available backups to test
        recovery capabilities as part of business continuity plan testing?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.6
      name: Transfer to Alternate Storage Site
      description: Mechanisms exist to transfer backup data to the alternate storage
        site at a rate that is capable of meeting both Recovery Time Objectives (RTOs)
        and Recovery Point Objectives (RPOs).
      annotation: Does the organization transfer backup data to the alternate storage
        site at a rate that is capable of meeting both Recovery Time Objectives (RTOs)
        and Recovery Point Objectives (RPOs)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.7
      name: Redundant Secondary System
      description: Mechanisms exist to maintain a failover system, which is not collocated
        with the primary system, application and/or service, which can be activated
        with little-to-no loss of information or disruption to operations.
      annotation: Does the organization maintain a failover system, which is not collocated
        with the primary system, application and/or service, which can be activated
        with little-to-no loss of information or disruption to operations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.8
      name: Dual Authorization For Backup Media Destruction
      description: Mechanisms exist to implement and enforce dual authorization for
        the deletion or destruction of sensitive backup media and data.
      annotation: Does the organization implement and enforce dual authorization for
        the deletion or destruction of sensitive backup media and data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.9
      name: Backup Access
      description: Mechanisms exist to restrict access to backups to privileged users
        with assigned roles for data backup and recovery operations.
      annotation: Does the organization restrict access to backups to privileged users
        with assigned roles for data backup and recovery operations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-11.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-11.10
      name: Backup Modification and/or Destruction
      description: Mechanisms exist to restrict access to modify and/or delete backups
        to privileged users with assigned data backup and recovery operations roles.
      annotation: Does the organization restrict access to modify and/or delete backups
        to privileged users with assigned data backup and recovery operations roles?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-12
      name: Information System Recovery & Reconstitution
      description: Mechanisms exist to ensure the secure recovery and reconstitution
        of systems to a known state after a disruption, compromise or failure.
      annotation: Does the organization ensure the secure recovery and reconstitution
        of systems to a known state after a disruption, compromise or failure?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-12.1
      name: Transaction Recovery
      description: Mechanisms exist to utilize specialized backup mechanisms that
        will allow transaction recovery for transaction-based applications and services
        in accordance with Recovery Point Objectives (RPOs).
      annotation: Does the organization utilize specialized backup mechanisms that
        will allow transaction recovery for transaction-based applications and services
        in accordance with Recovery Point Objectives (RPOs)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-12.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-12.2
      name: Failover Capability
      description: Mechanisms exist to implement real-time or near-real-time failover
        capability to maintain availability of critical systems, applications and/or
        services.
      annotation: Does the organization implement real-time or near-real-time failover
        capability to maintain availability of critical systems, applications and/or
        services?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-12.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-12.3
      name: Electronic Discovery (eDiscovery)
      description: Mechanisms exist to utilize electronic discovery (eDiscovery) that
        covers current and archived communication transactions.
      annotation: Does the organization utilize electronic discovery (eDiscovery)
        that covers current and archived communication transactions?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-12.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-12.4
      name: Restore Within Time Period
      description: Mechanisms exist to restore systems, applications and/or services
        within organization-defined restoration time-periods from configuration-controlled
        and integrity-protected information; representing a known, operational state
        for the asset.
      annotation: Does the organization restore systems, applications and/or services
        within organization-defined restoration time-periods from configuration-controlled
        and integrity-protected information; representing a known, operational state
        for the asset?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-13
      name: Backup & Restoration Hardware Protection
      description: Mechanisms exist to protect backup and restoration hardware and
        software.
      annotation: Does the organization protect backup and restoration hardware and
        software?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-13.1
      name: Restoration Integrity Verification
      description: Mechanisms exist to verify the integrity of backups and other restoration
        assets prior to using them for restoration.
      annotation: Does the organization verify the integrity of backups and other
        restoration assets prior to using them for restoration?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-14
      name: Isolated Recovery Environment
      description: Mechanisms exist to utilize an isolated, non-production environment
        to perform data backup and recovery operations through offline, cloud or off-site
        capabilities.
      annotation: Does the organization utilize an isolated, non-production environment
        to perform data backup and recovery operations through offline, cloud or off-site
        capabilities?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-15
      name: Reserve Hardware
      description: Mechanisms exist to purchase and maintain a sufficient reserve
        of spare hardware to ensure essential missions and business functions can
        be maintained in the event of a supply chain disruption.
      annotation: Does the organization purchase and maintain a sufficient reserve
        of spare hardware to ensure essential missions and business functions can
        be maintained in the event of a supply chain disruption?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:bcd
      ref_id: BCD-16
      name: AI & Autonomous Technologies Incidents
      description: Mechanisms exist to handle failures or incidents with Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) deemed to be high-risk.
      annotation: Does the organization handle failures or incidents with Artificial
        Intelligence (AI) and Autonomous Technologies (AAT) deemed to be high-risk?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      assessable: false
      depth: 1
      ref_id: CAP
      name: Capacity & Performance Planning
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      ref_id: CAP-01
      name: Capacity & Performance Management
      description: Mechanisms exist to facilitate the implementation of capacity management
        controls to ensure optimal system performance to meet expected and anticipated
        future capacity requirements.
      annotation: Does the organization facilitate the implementation of capacity
        management controls to ensure optimal system performance to meet expected
        and anticipated future capacity requirements?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      ref_id: CAP-02
      name: Resource Priority
      description: Mechanisms exist to control resource utilization of systems that
        are susceptible to Denial of Service (DoS) attacks to limit and prioritize
        the use of resources.
      annotation: Does the organization control resource utilization of systems that
        are susceptible to Denial of Service (DoS) attacks to limit and prioritize
        the use of resources?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      ref_id: CAP-03
      name: Capacity Planning
      description: Mechanisms exist to conduct capacity planning so that necessary
        capacity for information processing, telecommunications and environmental
        support will exist during contingency operations.
      annotation: Does the organization conduct capacity planning so that necessary
        capacity for information processing, telecommunications and environmental
        support will exist during contingency operations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      ref_id: CAP-04
      name: Performance Monitoring
      description: Automated mechanisms exist to centrally-monitor and alert on the
        operating state and health status of critical systems, applications and services.
      annotation: Does the organization use automated mechanisms to centrally-monitor
        and alert on the operating state and health status of critical systems, applications
        and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      ref_id: CAP-05
      name: Elastic Expansion
      description: Mechanisms exist to automatically scale the resources available
        for services, as demand conditions change.
      annotation: Does the organization automatically scale the resources available
        for services, as demand conditions change?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cap
      ref_id: CAP-06
      name: Regional Delivery
      description: Mechanisms exist to support operations that are geographically
        dispersed via regional delivery of technological services.
      annotation: Does the organization support operations that are geographically
        dispersed via regional delivery of technological services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      assessable: false
      depth: 1
      ref_id: CHG
      name: Change Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-01
      name: Change Management Program
      description: Mechanisms exist to facilitate the implementation of a change management
        program.
      annotation: Does the organization facilitate the implementation of a change
        management program?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-02
      name: Configuration Change Control
      description: Mechanisms exist to govern the technical configuration change control
        processes.
      annotation: Does the organization govern the technical configuration change
        control processes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-02.1
      name: Prohibition Of Changes
      description: Mechanisms exist to prohibit unauthorized changes, unless organization-approved
        change requests are received.
      annotation: Does the organization prohibit unauthorized changes, unless organization-approved
        change requests are received?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-02.2
      name: Test, Validate & Document Changes
      description: Mechanisms exist to appropriately test and document proposed changes
        in a non-production environment before changes are implemented in a production
        environment.
      annotation: Does the organization appropriately test and document proposed changes
        in a non-production environment before changes are implemented in a production
        environment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-02.3
      name: Cybersecurity & Data Privacy Representative for Asset Lifecycle Changes
      description: Mechanisms exist to include a cybersecurity and/or data privacy
        representative in the configuration change control review process.
      annotation: Does the organization include a cybersecurity and/or data privacy
        representative in the configuration change control review process?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-02.4
      name: Automated Security Response
      description: Automated mechanisms exist to implement remediation actions upon
        the detection of unauthorized baseline configurations change(s).
      annotation: Does the organization use automated mechanisms to implement remediation
        actions upon the detection of unauthorized baseline configurations change(s)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-02.5
      name: Cryptographic Management
      description: Mechanisms exist to govern assets involved in providing cryptographic
        protections according to the organization's configuration management processes.
      annotation: Does the organization govern assets involved in providing cryptographic
        protections according to its configuration management processes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-03
      name: Security Impact Analysis for Changes
      description: Mechanisms exist to analyze proposed changes for potential security
        impacts, prior to the implementation of the change.
      annotation: Does the organization analyze proposed changes for potential security
        impacts, prior to the implementation of the change?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-04
      name: Access Restriction For Change
      description: Mechanisms exist to enforce configuration restrictions in an effort
        to restrict the ability of users to conduct unauthorized changes.
      annotation: Does the organization enforce configuration restrictions in an effort
        to restrict the ability of users to conduct unauthorized changes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-04.1
      name: Automated Access Enforcement / Auditing
      description: Mechanisms exist to perform after-the-fact reviews of configuration
        change logs to discover any unauthorized changes.
      annotation: Does the organization perform after-the-fact reviews of configuration
        change logs to discover any unauthorized changes?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-04.2
      name: Signed Components
      description: Mechanisms exist to prevent the installation of software and firmware
        components without verification that the component has been digitally signed
        using an organization-approved certificate authority.
      annotation: Does the organization prevent the installation of software and firmware
        components without verification that the component has been digitally signed
        using an organization-approved certificate authority?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-04.3
      name: Dual Authorization for Change
      description: Mechanisms exist to enforce a two-person rule for implementing
        changes to critical assets.
      annotation: Does the organization enforce a two-person rule for implementing
        changes to critical assets?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-04.4
      name: Permissions To Implement Changes
      description: Mechanisms exist to limit operational privileges for implementing
        changes.
      annotation: Does the organization limit operational privileges for implementing
        changes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-04.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-04.5
      name: Library Privileges
      description: Mechanisms exist to restrict software library privileges to those
        individuals with a pertinent business need for access.
      annotation: Does the organization restrict software library privileges to those
        individuals with a pertinent business need for access?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-05
      name: Stakeholder Notification of Changes
      description: Mechanisms exist to ensure stakeholders are made aware of and understand
        the impact of proposed changes.
      annotation: Does the organization ensure stakeholders are made aware of and
        understand the impact of proposed changes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-06
      name: Control Functionality Verification
      description: Mechanisms exist to verify the functionality of cybersecurity and/or
        data privacy controls following implemented changes to ensure applicable controls
        operate as designed.
      annotation: Does the organization verify the functionality of cybersecurity
        and/or data privacy controls following implemented changes to ensure applicable
        controls operate as designed?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-07
      name: Emergency Changes
      description: Mechanisms exist to govern change management procedures for "emergency"
        changes.
      annotation: Does the organization govern change management procedures for "emergency"
        changes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-07.1
      name: Documenting Emergency Changes
      description: Mechanisms exist to document the results of "emergency" changes,
        including an explanation for why standard change management procedures could
        not be followed.
      annotation: Does the organization document the results of "emergency" changes,
        including an explanation for why standard change management procedures could
        not be followed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:chg
      ref_id: CHG-06.1
      name: Report Verification Results
      description: Mechanisms exist to report the results of cybersecurity & data
        privacy function verification to appropriate organizational management.
      annotation: Does the organization report the results of cybersecurity & data
        privacy function verification to appropriate organizational management?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      assessable: false
      depth: 1
      ref_id: CLD
      name: Cloud Security
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-01
      name: Cloud Services
      description: Mechanisms exist to facilitate the implementation of cloud management
        controls to ensure cloud instances are secure and in-line with industry practices.
      annotation: Does the organization facilitate the implementation of cloud management
        controls to ensure cloud instances are secure and in-line with industry practices?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-01.1
      name: Cloud Infrastructure Onboarding
      description: Mechanisms exist to ensure cloud services are designed and configured
        so systems, applications and processes are secured in accordance with applicable
        organizational standards, as well as statutory, regulatory and contractual
        obligations.
      annotation: Does the organization ensure cloud services are designed and configured
        so systems, applications and processes are secured in accordance with applicable
        organizational standards, as well as statutory, regulatory and contractual
        obligations?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-01.2
      name: Cloud Infrastructure Offboarding
      description: Mechanisms exist to ensure cloud services are decommissioned so
        that data is securely transitioned to new systems or archived in accordance
        with applicable organizational standards, as well as statutory, regulatory
        and contractual obligations.
      annotation: Does the organization ensure cloud services are decommissioned so
        that data is securely transitioned to new systems or archived in accordance
        with applicable organizational standards, as well as statutory, regulatory
        and contractual obligations?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-02
      name: Cloud Security Architecture
      description: Mechanisms exist to ensure the cloud security architecture supports
        the organization's technology strategy to securely design, configure and maintain
        cloud employments.
      annotation: Does the organization ensure the cloud security architecture supports
        its technology strategy to securely design, configure and maintain cloud employments?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-03
      name: Cloud Infrastructure Security Subnet
      description: Mechanisms exist to host security-specific technologies in a dedicated
        subnet.
      annotation: Does the organization host security-specific technologies in a dedicated
        subnet?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-04
      name: Application & Program Interface (API) Security
      description: Mechanisms exist to ensure support for secure interoperability
        between components with Application & Program Interfaces (APIs).
      annotation: Does the organization ensure support for secure interoperability
        between components with Application & Program Interfaces (APIs)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-05
      name: Virtual Machine Images
      description: Mechanisms exist to ensure the integrity of virtual machine images
        at all times.
      annotation: Does the organization ensure the integrity of virtual machine images
        at all times?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-06
      name: Multi-Tenant Environments
      description: Mechanisms exist to ensure multi-tenant owned or managed assets
        (physical and virtual) are designed and governed such that provider and customer
        (tenant) user access is appropriately segmented from other tenant users.
      annotation: Does the organization ensure multi-tenant owned or managed assets
        (physical and virtual) are designed and governed such that provider and customer
        (tenant) user access is appropriately segmented from other tenant users?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-06.1
      name: Customer Responsibility Matrix (CRM)
      description: Mechanisms exist to formally document a Customer Responsibility
        Matrix (CRM), delineating assigned responsibilities for controls between the
        Cloud Service Provider (CSP) and its customers.
      annotation: Does the organization formally document a Customer Responsibility
        Matrix (CRM), delineating assigned responsibilities for controls between the
        Cloud Service Provider (CSP) and its customers?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-06.2
      name: Multi-Tenant Event Logging Capabilities
      description: Mechanisms exist to ensure Multi-Tenant Service Providers (MTSP)
        facilitate security event logging capabilities for its customers that are
        consistent with applicable statutory, regulatory and/or contractual obligations.
      annotation: Does the organization ensure Multi-Tenant Service Providers (MTSP)
        facilitate security event logging capabilities for its customers that are
        consistent with applicable statutory, regulatory and/or contractual obligations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-06.3
      name: Multi-Tenant Forensics Capabilities
      description: Mechanisms exist to ensure Multi-Tenant Service Providers (MTSP)
        facilitate prompt forensic investigations in the event of a suspected or confirmed
        security incident.
      annotation: Does the organization ensure Multi-Tenant Service Providers (MTSP)
        facilitate prompt forensic investigations in the event of a suspected or confirmed
        security incident?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-06.4
      name: Multi-Tenant Incident Response Capabilities
      description: Mechanisms exist to ensure Multi-Tenant Service Providers (MTSP)
        facilitate prompt response to suspected or confirmed security incidents and
        vulnerabilities, including timely notification to affected customers.
      annotation: Does the organization ensure Multi-Tenant Service Providers (MTSP)
        facilitate prompt response to suspected or confirmed security incidents and
        vulnerabilities, including timely notification to affected customers?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-07
      name: Data Handling & Portability
      description: Mechanisms exist to ensure cloud providers use secure protocols
        for the import, export and management of data in cloud-based services.
      annotation: Does the organization ensure cloud providers use secure protocols
        for the import, export and management of data in cloud-based services?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-08
      name: Standardized Virtualization Formats
      description: Mechanisms exist to ensure interoperability by requiring cloud
        providers to use industry-recognized formats and provide documentation of
        custom changes for review.
      annotation: Does the organization ensure interoperability by requiring cloud
        providers to use industry-recognized formats and provide documentation of
        custom changes for review?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-09
      name: Geolocation Requirements for Processing, Storage and Service Locations
      description: Mechanisms exist to control the location of cloud processing/storage
        based on business requirements that includes statutory, regulatory and contractual
        obligations.
      annotation: Does the organization control the location of cloud processing/storage
        based on business requirements that includes statutory, regulatory and contractual
        obligations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-10
      name: Sensitive Data In Public Cloud Providers
      description: Mechanisms exist to limit and manage the storage of sensitive/regulated
        data in public cloud providers.
      annotation: Does the organization limit and manage the storage of sensitive/regulated
        data in public cloud providers?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-11
      name: Cloud Access Security Broker (CASB)
      description: Mechanisms exist to utilize a Cloud Access Security Broker (CASB),
        or similar technology, to provide boundary protection and monitoring functions
        that both provide access to the cloud and protect the organization from misuse
        of cloud resources.
      annotation: Does the organization utilize a Cloud Access Security Broker (CASB),
        or similar technology, to provide boundary protection and monitoring functions
        that both provide access to the cloud and protect the organization from misuse
        of cloud resources?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-12
      name: Side Channel Attack Prevention
      description: Mechanisms exist to prevent "side channel attacks" when using a
        Content Delivery Network (CDN) by restricting access to the origin server's
        IP address to the CDN and an authorized management network.
      annotation: Does the organization prevent "side channel attacks" when using
        a Content Delivery Network (CDN) by restricting access to the origin server's
        IP address to the CDN and an authorized management network?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-13
      name: Hosted Systems, Applications & Services
      description: Mechanisms exist to specify applicable cybersecurity & data protection
        controls that must be implemented on external systems, consistent with the
        contractual obligations established with the External Service Providers (ESP)
        owning, operating and/or maintaining external systems, applications and/or
        services.
      annotation: Does the organization specify applicable cybersecurity & data protection
        controls that must be implemented on external systems, consistent with the
        contractual obligations established with the External Service Providers (ESP)
        owning, operating and/or maintaining external systems, applications and/or
        services?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-13.1
      name: Authorized Individuals For Hosted Systems, Applications & Services
      description: Mechanisms exist to authorize specified individuals to access External
        Service Providers (ESP) owned, operated and/or maintained external systems,
        applications and/or services.
      annotation: Does the organization authorize specified individuals to access
        External Service Providers (ESP) owned, operated and/or maintained external
        systems, applications and/or services?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-13.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-13.2
      name: Sensitive/Regulated Data On Hosted Systems, Applications & Services
      description: Mechanisms exist to define formal processes to store, process and/or
        transmit sensitive/regulated data using External Service Providers (ESP) owned,
        operated and/or maintained external systems, applications and/or services
        , in accordance with all applicable statutory, regulatory and/or contractual
        obligations.
      annotation: Does the organization define formal processes to store, process
        and/or transmit sensitive/regulated data using External Service Providers
        (ESP) owned, operated and/or maintained external systems, applications and/or
        services , in accordance with all applicable statutory, regulatory and/or
        contractual obligations?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cld
      ref_id: CLD-14
      name: Prohibition On Unverified Hosted Systems, Applications & Services
      description: Mechanisms exist to prohibit access to, or usage of, hosted systems,
        applications and/or services until applicable cybersecurity & data protection
        control implementation is verified.
      annotation: Does the organization prohibit access to, or usage of, hosted systems,
        applications and/or services until applicable cybersecurity & data protection
        control implementation is verified?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      assessable: false
      depth: 1
      ref_id: CPL
      name: Compliance
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-01
      name: Statutory, Regulatory & Contractual Compliance
      description: Mechanisms exist to facilitate the identification and implementation
        of relevant statutory, regulatory and contractual controls.
      annotation: Does the organization facilitate the identification and implementation
        of relevant statutory, regulatory and contractual controls?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-01.1
      name: Non-Compliance Oversight
      description: Mechanisms exist to document and review instances of non-compliance
        with statutory, regulatory and/or contractual obligations to develop appropriate
        risk mitigation actions.
      annotation: Does the organization document and review instances of non-compliance
        with statutory, regulatory and/or contractual obligations to develop appropriate
        risk mitigation actions?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-01.2
      name: Compliance Scope
      description: Mechanisms exist to document and validate the scope of cybersecurity
        & data privacy controls that are determined to meet statutory, regulatory
        and/or contractual compliance obligations.
      annotation: Does the organization document and validate the scope of cybersecurity
        & data privacy controls that are determined to meet statutory, regulatory
        and/or contractual compliance obligations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-01.3
      name: Ability To Demonstrate Conformity
      description: Mechanisms exist to ensure the organization is able to demonstrate
        conformity with applicable cybersecurity and data protection laws, regulations
        and/or contractual obligations.
      annotation: Does the organization ensure it is able to demonstrate conformity
        with applicable cybersecurity and data protection laws, regulations and/or
        contractual obligations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-01.4
      name: Conformity Assessment
      description: Mechanisms exist to conduct assessments to demonstrate conformity
        with applicable cybersecurity and data protection laws, regulations and/or
        contractual obligations.
      annotation: Does the organization conduct assessments to demonstrate conformity
        with applicable cybersecurity and data protection laws, regulations and/or
        contractual obligations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-01.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-01.5
      name: Declaration of Conformity
      description: 'Mechanisms exist to generate a declaration of conformity for each
        conformity assessment, where the document:

        (1) Is concise;

        (2) Unambiguously reflects the current status;

        (3) Is physically or electronically signed; and

        (4) Where possible, is machine readable.'
      annotation: 'Does the organization generate a declaration of conformity for
        each conformity assessment, where the document:

        (1) Is concise;

        (2) Unambiguously reflects the current status;

        (3) Is physically or electronically signed; and

        (4) Where possible, is machine readable?'
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-02
      name: Cybersecurity & Data Protection Controls Oversight
      description: Mechanisms exist to provide a cybersecurity & data protection controls
        oversight function that reports to the organization's executive leadership.
      annotation: Does the organization provide a cybersecurity & data protection
        controls oversight function that reports to its executive leadership?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-02.1
      name: Internal Audit Function
      description: Mechanisms exist to implement an internal audit function that is
        capable of providing senior organization management with insights into the
        appropriateness of the organization's technology and information governance
        processes.
      annotation: Does the organization implement an internal audit function that
        is capable of providing senior organization management with insights into
        the appropriateness of its technology and information governance processes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-02.2
      name: Periodic Audits
      description: Mechanisms exist to conduct periodic audits of cybersecurity &
        data protection controls to evaluate conformity with the organization's documented
        policies, standards and procedures.
      annotation: Does the organization conduct periodic audits of cybersecurity &
        data protection controls to evaluate conformity with its documented policies,
        standards and procedures?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-02.3
      name: Corrective Action
      description: Mechanisms exist to take corrective action to remediate instances
        of non-conformity with applicable statutory, regulatory, and/or contractual
        compliance obligations.
      annotation: Does the organization take corrective action to remediate instances
        of non-conformity with applicable statutory, regulatory, and/or contractual
        compliance obligations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-03
      name: Cybersecurity & Data Protection Assessments
      description: Mechanisms exist to regularly review processes and documented procedures
        to ensure conformity with the organization's cybersecurity & data protection
        policies, standards and other applicable requirements.
      annotation: Does the organization regularly review processes and documented
        procedures to ensure conformity with the organization's cybersecurity & data
        protection policies, standards and other applicable requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-03.1
      name: Independent Assessors
      description: Mechanisms exist to utilize independent assessors to evaluate cybersecurity
        & data protection controls at planned intervals or when the system, service
        or project undergoes significant changes.
      annotation: Does the organization utilize independent assessors to evaluate
        cybersecurity & data protection controls at planned intervals or when the
        system, service or project undergoes significant changes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-03.2
      name: Functional Review Of Cybersecurity & Data Protection Controls
      description: Mechanisms exist to regularly review technology assets for adherence
        to the organization's cybersecurity & data protection policies and standards.
      annotation: Does the organization regularly review technology assets for adherence
        to its cybersecurity & data protection policies and standards?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-03.3
      name: Assessor Access
      description: "Mechanisms exist to grant assessors minimum necessary access to\
        \ conduct conformity assessments, including:\n(1) Logical access to design,\
        \ development, production, inspection and testing artifacts; and \n(2) Physical\
        \ access to facilities."
      annotation: "Does the organization grant assessors minimum necessary access\
        \ to conduct conformity assessments, including:\n(1) Logical access to design,\
        \ development, production, inspection and testing artifacts; and \n(2) Physical\
        \ access to facilities?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-04
      name: Audit Activities
      description: Mechanisms exist to thoughtfully plan audits by including input
        from operational risk and compliance partners to minimize the impact of audit-related
        activities on business operations.
      annotation: Does the organization thoughtfully plan audits by including input
        from operational risk and compliance partners to minimize the impact of audit-related
        activities on business operations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-05
      name: Legal Assessment of Investigative Inquires
      description: Mechanisms exist to determine whether a government agency has an
        applicable and valid legal basis to request data from the organization and
        what further steps need to be taken, if necessary.
      annotation: Does the organization determine whether a government agency has
        an applicable and valid legal basis to request data from the organization
        and what further steps need to be taken, if necessary?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-05.1
      name: Investigation Request Notifications
      description: Mechanisms exist to notify customers about investigation request
        notifications, unless the applicable legal basis for a government agency's
        action prohibits notification (e.g., potential criminal prosecution).
      annotation: Does the organization notify customers about investigation request
        notifications, unless the applicable legal basis for a government agency's
        action prohibits notification (e.g., potential criminal prosecution)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-05.2
      name: Investigation Access Restrictions
      description: Mechanisms exist to support official investigations by provisioning
        government investigators with "least privileges" and "least functionality"
        to ensure that government investigators only have access to the data and systems
        needed to perform the investigation.
      annotation: Does the organization support official investigations by provisioning
        government investigators with "least privileges" and "least functionality"
        to ensure that government investigators only have access to the data and systems
        needed to perform the investigation?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-06
      name: Government Surveillance
      description: Mechanisms exist to constrain the host government from having unrestricted
        and non-monitored access to the organization's systems, applications and services
        that could potentially violate other applicable statutory, regulatory and/or
        contractual obligations.
      annotation: Does the organization constrain the host government from having
        unrestricted and non-monitored access to its systems, applications and services
        that could potentially violate other applicable statutory, regulatory and/or
        contractual obligations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-07
      name: Grievances
      description: Mechanisms exist to govern the intake and analysis of grievances
        related to the organization's cybersecurity and/or data protection practices.
      annotation: Does the organization govern the intake, analysis, assignment and
        remediation of grievances related to its cybersecurity and/or data protection
        practices?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-07.1
      name: Grievance Response
      description: Mechanisms exist to respond to legitimate grievances related to
        the organization's cybersecurity and/or data protection practices.
      annotation: Does the organization respond to legitimate grievances related to
        its cybersecurity and/or data protection practices?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-08
      name: Localized Representation
      description: Mechanisms exist to appoint localized representation with a physical
        presence in localities, as required by applicable laws and/or regulations.
      annotation: Does the organization appoint localized representation with a physical
        presence in localities, as required by applicable laws and/or regulations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cpl
      ref_id: CPL-08.1
      name: Representative Powers
      description: Mechanisms exist to contract localized representation to perform
        specified functions in regard to representing statutory and/or regulatory
        compliance matters.
      annotation: Does the organization contract localized representation to perform
        specified functions in regard to representing statutory and/or regulatory
        compliance matters?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      assessable: false
      depth: 1
      ref_id: CFG
      name: Configuration Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-01
      name: Configuration Management Program
      description: Mechanisms exist to facilitate the implementation of configuration
        management controls.
      annotation: Does the organization facilitate the implementation of configuration
        management controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-01.1
      name: Assignment of Responsibility
      description: Mechanisms exist to implement a segregation of duties for configuration
        management that prevents developers from performing production configuration
        management duties.
      annotation: Does the organization implement a segregation of duties for configuration
        management that prevents developers from performing production configuration
        management duties?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02
      name: System Hardening Through Baseline Configurations
      description: Mechanisms exist to develop, document and maintain secure baseline
        configurations for technology platforms that are consistent with industry-accepted
        system hardening standards.
      annotation: Does the organization develop, document and maintain secure baseline
        configurations for technology platforms that are consistent with industry-accepted
        system hardening standards?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.1
      name: Reviews & Updates
      description: 'Mechanisms exist to review and update baseline configurations:

        (1) At least annually;

        (2) When required due to so; or

        (3) As part of system component installations and upgrades.'
      annotation: "Does the organization review and update baseline configurations:\n\
        \ (1) At least annually;\n (2) When required due to so; or\n (3) As part of\
        \ system component installations and upgrades?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.2
      name: Automated Central Management & Verification
      description: Automated mechanisms exist to govern and report on baseline configurations
        of systems through Continuous Diagnostics and Mitigation (CDM), or similar
        technologies.
      annotation: Does the organization use automated mechanisms to govern and report
        on baseline configurations of systems through Continuous Diagnostics and Mitigation
        (CDM), or similar technologies?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.3
      name: Retention Of Previous Configurations
      description: Mechanisms exist to retain previous versions of baseline configuration
        to support roll back.
      annotation: Does the organization retain previous versions of baseline configuration
        to support roll back?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.4
      name: Development & Test Environment Configurations
      description: Mechanisms exist to manage baseline configurations for development
        and test environments separately from operational baseline configurations
        to minimize the risk of unintentional changes.
      annotation: Does the organization manage baseline configurations for development
        and test environments separately from operational baseline configurations
        to minimize the risk of unintentional changes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.5
      name: Configure Systems, Components or Services for High-Risk Areas
      description: Mechanisms exist to configure systems utilized in high-risk areas
        with more restrictive baseline configurations.
      annotation: Does the organization configure systems utilized in high-risk areas
        with more restrictive baseline configurations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.6
      name: Network Device Configuration File Synchronization
      description: Mechanisms exist to configure network devices to synchronize startup
        and running configuration files.
      annotation: Does the organization configure network devices to synchronize startup
        and running configuration files?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.7
      name: Approved Configuration Deviations
      description: Mechanisms exist to document, assess risk and approve or deny deviations
        to standardized configurations.
      annotation: Does the organization document, assess risk and approve or deny
        deviations to standardized configurations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.8
      name: Respond To Unauthorized Changes
      description: Mechanisms exist to respond to unauthorized changes to configuration
        settings as security incidents.
      annotation: Does the organization respond to unauthorized changes to configuration
        settings as security incidents?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-02.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-02.9
      name: Baseline Tailoring
      description: 'Mechanisms exist to allow baseline controls to be specialized
        or customized by applying a defined set of tailoring actions that are specific
        to:

        (1) Mission / business functions;

        (2) Operational environment;

        (3) Specific threats or vulnerabilities; or

        (4) Other conditions or situations that could affect mission / business success.'
      annotation: "Does the organization allow baseline controls to be specialized\
        \ or customized by applying a defined set of tailoring actions that are specific\
        \ to:\n (1) Mission / business functions;\n (2) Operational environment;\n\
        \ (3) Specific threats or vulnerabilities; or\n (4) Other conditions or situations\
        \ that could affect mission / business success?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-03
      name: Least Functionality
      description: Mechanisms exist to configure systems to provide only essential
        capabilities by specifically prohibiting or restricting the use of ports,
        protocols, and/or services.
      annotation: Does the organization configure systems to provide only essential
        capabilities by specifically prohibiting or restricting the use of ports,
        protocols, and/or services?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-03.1
      name: Periodic Review
      description: Mechanisms exist to periodically review system configurations to
        identify and disable unnecessary and/or non-secure functions, ports, protocols
        and services.
      annotation: Does the organization periodically review system configurations
        to identify and disable unnecessary and/or non-secure functions, ports, protocols
        and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-03.2
      name: Prevent Unauthorized Software Execution
      description: Mechanisms exist to configure systems to prevent the execution
        of unauthorized software programs.
      annotation: Does the organization configure systems to prevent the execution
        of unauthorized software programs?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-03.3
      name: Explicitly Allow / Deny Applications
      description: Mechanisms exist to explicitly allow (allowlist / whitelist) and/or
        block (denylist / blacklist) applications that are authorized to execute on
        systems.
      annotation: Does the organization explicitly allow (allowlist / whitelist) and/or
        block (denylist / blacklist) applications that are authorized to execute on
        systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-03.4
      name: Split Tunneling
      description: Mechanisms exist to prevent split tunneling for remote devices
        unless the split tunnel is securely provisioned using organization-defined
        safeguards.
      annotation: 'Does the organization prevent split tunneling for remote devices
        unless the split tunnel is securely provisioned using organization-defined
        safeguards?


        Prevent split tunneling for remote devices unless the split tunnel is securely
        provisioned using organization-defined safeguards?'
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-04
      name: Software Usage Restrictions
      description: Mechanisms exist to enforce software usage restrictions to comply
        with applicable contract agreements and copyright laws.
      annotation: Does the organization enforce software usage restrictions to comply
        with applicable contract agreements and copyright laws?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-04.1
      name: Open Source Software
      description: Mechanisms exist to establish parameters for the secure use of
        open source software.
      annotation: Does the organization establish parameters for the secure use of
        open source software?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-04.2
      name: Unsupported Internet Browsers & Email Clients
      description: Mechanisms exist to allow only approved Internet browsers and email
        clients to run on systems.
      annotation: Does the organization allow only approved Internet browsers and
        email clients to run on systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-05
      name: User-Installed Software
      description: Mechanisms exist to restrict the ability of non-privileged users
        to install unauthorized software.
      annotation: Does the organization restrict the ability of non-privileged users
        to install unauthorized software?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-05.1
      name: Unauthorized Installation Alerts
      description: Mechanisms exist to configure systems to generate an alert when
        the unauthorized installation of software is detected.
      annotation: Does the organization configure systems to generate an alert when
        the unauthorized installation of software is detected?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-05.2
      name: Restrict Roles Permitted To Install Software
      description: Mechanisms exist to configure systems to prevent the installation
        of software, unless the action is performed by a privileged user or service.
      annotation: Does the organization configure systems to prevent the installation
        of software, unless the action is performed by a privileged user or service?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-06
      name: Configuration Enforcement
      description: Automated mechanisms exist to monitor, enforce and report on configurations
        for endpoint devices.
      annotation: Does the organization use automated mechanisms to monitor, enforce
        and report on configurations for endpoint devices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-06.1
      name: Integrity Assurance & Enforcement (IAE)
      description: Automated mechanisms exist to identify unauthorized deviations
        from an approved baseline and implement automated resiliency actions to remediate
        the unauthorized change.
      annotation: Does the organization use automated mechanisms to identify unauthorized
        deviations from an approved baseline and implement automated resiliency actions
        to remediate the unauthorized change?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-07
      name: Zero-Touch Provisioning (ZTP)
      description: Mechanisms exist to implement Zero-Touch Provisioning (ZTP), or
        similar technology, to automatically and securely configure devices upon being
        added to a network.
      annotation: Does the organization implement Zero-Touch Provisioning (ZTP), or
        similar technology, to automatically and securely configure devices upon being
        added to a network?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-08
      name: Sensitive / Regulated Data Access Enforcement
      description: Mechanisms exist to configure systems, applications and processes
        to restrict access to sensitive/regulated data.
      annotation: Does the organization configure systems, applications and processes
        to restrict access to sensitive/regulated data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cfg
      ref_id: CFG-08.1
      name: Sensitive / Regulated Data Actions
      description: Automated mechanisms exist to generate event logs whenever sensitive/regulated
        data is collected, created, updated, deleted and/or archived.
      annotation: Does the organization use automated mechanisms to generate event
        logs whenever sensitive/regulated data is collected, created, updated, deleted
        and/or archived?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      assessable: false
      depth: 1
      ref_id: MON
      name: Continuous Monitoring
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01
      name: Continuous Monitoring
      description: Mechanisms exist to facilitate the implementation of enterprise-wide
        monitoring controls.
      annotation: Does the organization facilitate the implementation of enterprise-wide
        monitoring controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.1
      name: Intrusion Detection & Prevention Systems (IDS & IPS)
      description: Mechanisms exist to implement Intrusion Detection / Prevention
        Systems (IDS / IPS) technologies on critical systems, key network segments
        and network choke points.
      annotation: Does the organization implement Intrusion Detection / Prevention
        Systems (IDS / IPS) technologies on critical systems, key network segments
        and network choke points?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.2
      name: Automated Tools for Real-Time Analysis
      description: Mechanisms exist to utilize a Security Incident Event Manager (SIEM),
        or similar automated tool, to support near real-time analysis and incident
        escalation.
      annotation: Does the organization utilize a Security Incident Event Manager
        (SIEM), or similar automated tool, to support near real-time analysis and
        incident escalation?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.3
      name: Inbound & Outbound Communications Traffic
      description: Mechanisms exist to continuously monitor inbound and outbound communications
        traffic for unusual or unauthorized activities or conditions.
      annotation: Does the organization continuously monitor inbound and outbound
        communications traffic for unusual or unauthorized activities or conditions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.4
      name: System Generated Alerts
      description: Mechanisms exist to generate, monitor, correlate and respond to
        alerts from physical, cybersecurity, data privacy and supply chain activities
        to achieve integrated situational awareness.
      annotation: Does the organization generate, monitor, correlate and respond to
        alerts from physical, cybersecurity, data privacy and supply chain activities
        to achieve integrated situational awareness?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.5
      name: Wireless Intrusion Detection System (WIDS)
      description: Mechanisms exist to utilize Wireless Intrusion Detection / Protection
        Systems (WIDS / WIPS) to identify rogue wireless devices and to detect attack
        attempts via wireless networks.
      annotation: Does the organization utilize Wireless Intrusion Detection / Protection
        Systems (WIDS / WIPS) to identify rogue wireless devices and to detect attack
        attempts via wireless networks?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.6
      name: Host-Based Devices
      description: Mechanisms exist to utilize Host-based Intrusion Detection / Prevention
        Systems (HIDS / HIPS) to actively alert on or block unwanted activities and
        send logs to a Security Incident Event Manager (SIEM), or similar automated
        tool, to maintain situational awareness.
      annotation: Does the organization utilize Host-based Intrusion Detection / Prevention
        Systems (HIDS / HIPS) to actively alert on or block unwanted activities and
        send logs to a Security Incident Event Manager (SIEM), or similar automated
        tool, to maintain situational awareness?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.7
      name: File Integrity Monitoring (FIM)
      description: Mechanisms exist to utilize a File Integrity Monitor (FIM), or
        similar change-detection technology, on critical assets to generate alerts
        for unauthorized modifications.
      annotation: Does the organization utilize a File Integrity Monitor (FIM), or
        similar change-detection technology, on critical assets to generate alerts
        for unauthorized modifications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.8
      name: Security Event Monitoring
      description: Mechanisms exist to review event logs on an ongoing basis and escalate
        incidents in accordance with established timelines and procedures.
      annotation: Does the organization review event logs on an ongoing basis and
        escalate incidents in accordance with established timelines and procedures?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.9
      name: Proxy Logging
      description: Mechanisms exist to log all Internet-bound requests, in order to
        identify prohibited activities and assist incident handlers with identifying
        potentially compromised systems.
      annotation: Does the organization log all Internet-bound requests, in order
        to identify prohibited activities and assist incident handlers with identifying
        potentially compromised systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.10
      name: Deactivated Account Activity
      description: Mechanisms exist to monitor deactivated accounts for attempted
        usage.
      annotation: Does the organization monitor deactivated accounts for attempted
        usage?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.11
      name: Automated Response to Suspicious Events
      description: Mechanisms exist to automatically implement pre-determined corrective
        actions in response to detected events that have security incident implications.
      annotation: Does the organization automatically implement pre-determined corrective
        actions in response to detected events that have security incident implications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.12
      name: Automated Alerts
      description: Mechanisms exist to automatically alert incident response personnel
        to inappropriate or anomalous activities that have potential security incident
        implications.
      annotation: Does the organization automatically alert incident response personnel
        to inappropriate or anomalous activities that have potential security incident
        implications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.13
      name: Alert Threshold Tuning
      description: Mechanisms exist to "tune" event monitoring technologies through
        analyzing communications traffic/event patterns and developing profiles representing
        common traffic patterns and/or events.
      annotation: Does the organization "tune" event monitoring technologies through
        analyzing communications traffic/event patterns and developing profiles representing
        common traffic patterns and/or events?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.14
      name: Individuals Posing Greater Risk
      description: Mechanisms exist to implement enhanced activity monitoring for
        individuals who have been identified as posing an increased level of risk.
      annotation: Does the organization implement enhanced activity monitoring for
        individuals who have been identified as posing an increased level of risk?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.15
      name: Privileged User Oversight
      description: Mechanisms exist to implement enhanced activity monitoring for
        privileged users.
      annotation: Does the organization implement enhanced activity monitoring for
        privileged users?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.16
      name: Analyze and Prioritize Monitoring Requirements
      description: Mechanisms exist to assess the organization's needs for monitoring
        and prioritize the monitoring of assets, based on asset criticality and the
        sensitivity of the data it stores, transmits and processes.
      annotation: Does the organization assess its needs for monitoring and prioritize
        the monitoring of assets, based on asset criticality and the sensitivity of
        the data it stores, transmits and processes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-01.17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-01.17
      name: Real-Time Session Monitoring
      description: Mechanisms exist to enable authorized personnel the ability to
        remotely view and hear content related to an established user session in real
        time, in accordance with organizational standards, as well as statutory, regulatory
        and contractual obligations.
      annotation: Does the organization enable authorized personnel the ability to
        remotely view and hear content related to an established user session in real
        time, in accordance with organizational standards, as well as statutory, regulatory
        and contractual obligations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02
      name: Centralized Collection of Security Event Logs
      description: Mechanisms exist to utilize a Security Incident Event Manager (SIEM),
        or similar automated tool, to support the centralized collection of security-related
        event logs.
      annotation: Does the organization utilize a Security Incident Event Manager
        (SIEM) or similar automated tool, to support the centralized collection of
        security-related event logs?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.1
      name: Correlate Monitoring Information
      description: Automated mechanisms exist to correlate both technical and non-technical
        information from across the enterprise by a Security Incident Event Manager
        (SIEM) or similar automated tool, to enhance organization-wide situational
        awareness.
      annotation: Does the organization use automated mechanisms to correlate both
        technical and non-technical information from across the enterprise by a Security
        Incident Event Manager (SIEM) or similar automated tool, to enhance organization-wide
        situational awareness?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.2
      name: Central Review & Analysis
      description: Automated mechanisms exist to centrally collect, review and analyze
        audit records from multiple sources.
      annotation: Does the organization use automated mechanisms to centrally collect,
        review and analyze audit records from multiple sources?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.3
      name: Integration of Scanning & Other Monitoring Information
      description: Automated mechanisms exist to integrate the analysis of audit records
        with analysis of vulnerability scanners, network performance, system monitoring
        and other sources to further enhance the ability to identify inappropriate
        or unusual activity.
      annotation: Does the organization use automated mechanisms to integrate the
        analysis of audit records with analysis of vulnerability scanners, network
        performance, system monitoring and other sources to further enhance the ability
        to identify inappropriate or unusual activity?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.4
      name: Correlation with Physical Monitoring
      description: Automated mechanisms exist to correlate information from audit
        records with information obtained from monitoring physical access to further
        enhance the ability to identify suspicious, inappropriate, unusual or malevolent
        activity.
      annotation: Does the organization use automated mechanisms to correlate information
        from audit records with information obtained from monitoring physical access
        to further enhance the ability to identify suspicious, inappropriate, unusual
        or malevolent activity?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.5
      name: Permitted Actions
      description: Mechanisms exist to specify the permitted actions for both users
        and systems associated with the review, analysis and reporting of audit information.
      annotation: Does the organization specify the permitted actions for both users
        and systems associated with the review, analysis and reporting of audit information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.6
      name: Audit Level Adjustments
      description: Mechanisms exist to adjust the level of audit review, analysis
        and reporting based on evolving threat information from law enforcement, industry
        associations or other credible sources of threat intelligence.
      annotation: Does the organization adjust the level of audit review, analysis
        and reporting based on evolving threat information from law enforcement, industry
        associations or other credible sources of threat intelligence?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.7
      name: System-Wide / Time-Correlated Audit Trail
      description: Automated mechanisms exist to compile audit records into an organization-wide
        audit trail that is time-correlated.
      annotation: Does the organization use automated mechanisms to compile audit
        records into an organization-wide audit trail that is time-correlated?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.8
      name: Changes by Authorized Individuals
      description: Mechanisms exist to provide privileged users or roles the capability
        to change the auditing to be performed on specified information system components,
        based on specific event criteria within specified time thresholds.
      annotation: Does the organization provide privileged users or roles the capability
        to change the auditing to be performed on specified information system components,
        based on specific event criteria within specified time thresholds?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-02.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-02.9
      name: Inventory of Technology Asset Event Logging
      description: Mechanisms exist to maintain a current and accurate inventory of
        technology assets being logged.
      annotation: Does the organization maintain a current and accurate inventory
        of technology assets being logged?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03
      name: Content of Event Logs
      description: "Mechanisms exist to configure systems to produce event logs that\
        \ contain sufficient information to, at a minimum:\n(1) Establish what type\
        \ of event occurred;\n(2) When (date and time) the event occurred;\n(3) Where\
        \ the event occurred;\n(4) The source of the event;\n(5) The outcome (success\
        \ or failure) of the event; and \n(6) The identity of any user/subject associated\
        \ with the event."
      annotation: "Does the organization configure systems to produce event logs that\
        \ contain sufficient information to, at a minimum:\n (1) Establish what type\
        \ of event occurred;\n (2) When (date and time) the event occurred;\n (3)\
        \ Where the event occurred;\n (4) The source of the event;\n (5) The outcome\
        \ (success or failure) of the event; and \n (6) The identity of any user/subject\
        \ associated with the event?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.1
      name: Sensitive Audit Information
      description: Mechanisms exist to protect sensitive/regulated data contained
        in log files.
      annotation: Does the organization protect sensitive/regulated data contained
        in log files?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.2
      name: Audit Trails
      description: Mechanisms exist to link system access to individual users or service
        accounts.
      annotation: Does the organization link system access to individual users or
        service accounts?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.3
      name: Privileged Functions Logging
      description: Mechanisms exist to log and review the actions of users and/or
        services with elevated privileges.
      annotation: Does the organization log and review the actions of users and/or
        services with elevated privileges?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.4
      name: Verbosity Logging for Boundary Devices
      description: Mechanisms exist to verbosely log all traffic (both allowed and
        blocked) arriving at network boundary devices, including firewalls, Intrusion
        Detection / Prevention Systems (IDS/IPS) and inbound and outbound proxies.
      annotation: Does the organization verbosely log all traffic (both allowed and
        blocked) arriving at network boundary devices, including firewalls, Intrusion
        Detection / Prevention Systems (IDS/IPS) and inbound and outbound proxies?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.5
      name: Limit Personal Data (PD) In Audit Records
      description: Mechanisms exist to limit Personal Data (PD) contained in audit
        records to the elements identified in the data privacy risk assessment.
      annotation: Does the organization limit Personal Data (PD) contained in audit
        records to the elements identified in the data privacy risk assessment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.6
      name: Centralized Management of Planned Audit Record Content
      description: Mechanisms exist to centrally manage and configure the content
        required to be captured in audit records generated by organization-defined
        information system components.
      annotation: Does the organization centrally manage and configure the content
        required to be captured in audit records generated by organization-defined
        information system components?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-03.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-03.7
      name: Database Logging
      description: Mechanisms exist to ensure databases produce audit records that
        contain sufficient information to monitor database activities.
      annotation: Does the organization ensure databases produce audit records that
        contain sufficient information to monitor database activities?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-04
      name: Event Log Storage Capacity
      description: Mechanisms exist to allocate and proactively manage sufficient
        event log storage capacity to reduce the likelihood of such capacity being
        exceeded.
      annotation: Does the organization allocate and proactively manage sufficient
        event log storage capacity to reduce the likelihood of such capacity being
        exceeded?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-05
      name: Response To Event Log Processing Failures
      description: Mechanisms exist to alert appropriate personnel in the event of
        a log processing failure and take actions to remedy the disruption.
      annotation: Does the organization alert appropriate personnel in the event of
        a log processing failure and take actions to remedy the disruption?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-05.1
      name: Real-Time Alerts of Event Logging Failure
      description: Mechanisms exist to provide 24x7x365 near real-time alerting capability
        when an event log processing failure occurs.
      annotation: Does the organization provide 24x7x365 near real-time alerting capability
        when an event log processing failure occurs?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-05.2
      name: Event Log Storage Capacity Alerting
      description: Automated mechanisms exist to alert appropriate personnel when
        the allocated volume reaches an organization-defined percentage of maximum
        event log storage capacity.
      annotation: Does the organization use automated mechanisms to alert appropriate
        personnel when the allocated volume reaches an organization-defined percentage
        of maximum event log storage capacity?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-06
      name: Monitoring Reporting
      description: Mechanisms exist to provide an event log report generation capability
        to aid in detecting and assessing anomalous activities.
      annotation: Does the organization provide an event log report generation capability
        to aid in detecting and assessing anomalous activities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-06.1
      name: Query Parameter Audits of Personal Data (PD)
      description: Mechanisms exist to provide and implement the capability for auditing
        the parameters of user query events for data sets containing Personal Data
        (PD).
      annotation: Does the organization provide and implement the capability for auditing
        the parameters of user query events for data sets containing Personal Data
        (PD)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-06.2
      name: Trend Analysis Reporting
      description: Mechanisms exist to employ trend analyses to determine if security
        control implementations, the frequency of continuous monitoring activities,
        and/or the types of activities used in the continuous monitoring process need
        to be modified based on empirical data.
      annotation: Does the organization employ trend analyses to determine if security
        control implementations, the frequency of continuous monitoring activities,
        and/or the types of activities used in the continuous monitoring process need
        to be modified based on empirical data?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-07
      name: Time Stamps
      description: Mechanisms exist to configure systems to use an authoritative time
        source to generate time stamps for event logs.
      annotation: Does the organization configure systems to use an authoritative
        time source to generate time stamps for event logs?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-07.1
      name: Synchronization With Authoritative Time Source
      description: Mechanisms exist to synchronize internal system clocks with an
        authoritative time source.
      annotation: Does the organization synchronize internal system clocks with an
        authoritative time source?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-08
      name: Protection of Event Logs
      description: Mechanisms exist to protect event logs and audit tools from unauthorized
        access, modification and deletion.
      annotation: Does the organization protect event logs and audit tools from unauthorized
        access, modification and deletion?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-08.1
      name: Event Log Backup on Separate Physical Systems / Components
      description: Mechanisms exist to back up event logs onto a physically different
        system or system component than the Security Incident Event Manager (SIEM)
        or similar automated tool.
      annotation: Does the organization back up event logs onto a physically different
        system or system component than the Security Incident Event Manager (SIEM)
        or similar automated tool?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-08.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-08.2
      name: Access by Subset of Privileged Users
      description: Mechanisms exist to restrict access to the management of event
        logs to privileged users with a specific business need.
      annotation: Does the organization restrict access to the management of event
        logs to privileged users with a specific business need?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-08.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-08.3
      name: Cryptographic Protection of Event Log Information
      description: Cryptographic mechanisms exist to protect the integrity of event
        logs and audit tools.
      annotation: Are cryptographic mechanisms utilized to protect the integrity of
        event logs and audit tools?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-08.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-08.4
      name: Dual Authorization for Event Log Movement
      description: Automated mechanisms exist to enforce dual authorization for the
        movement or deletion of event logs.
      annotation: Does the organization use automated mechanisms to enforce dual authorization
        for the movement or deletion of event logs?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-09
      name: Non-Repudiation
      description: Mechanisms exist to utilize a non-repudiation capability to protect
        against an individual falsely denying having performed a particular action.
      annotation: Does the organization utilize a non-repudiation capability to protect
        against an individual falsely denying having performed a particular action?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-09.1
      name: Identity Binding
      description: Mechanisms exist to bind the identity of the information producer
        to the information generated.
      annotation: Does the organization bind the identity of the information producer
        to the information generated?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-10
      name: Event Log Retention
      description: Mechanisms exist to retain event logs for a time period consistent
        with records retention requirements to provide support for after-the-fact
        investigations of security incidents and to meet statutory, regulatory and
        contractual retention requirements.
      annotation: Does the organization retain event logs for a time period consistent
        with records retention requirements to provide support for after-the-fact
        investigations of security incidents and to meet statutory, regulatory and
        contractual retention requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-11
      name: Monitoring For Information Disclosure
      description: Mechanisms exist to monitor for evidence of unauthorized exfiltration
        or disclosure of non-public information.
      annotation: Does the organization monitor for evidence of unauthorized exfiltration
        or disclosure of non-public information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-11.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-11.1
      name: Analyze Traffic for Covert Exfiltration
      description: Automated mechanisms exist to analyze network traffic to detect
        covert data exfiltration.
      annotation: Does the organization use automated mechanisms to analyze network
        traffic to detect covert data exfiltration?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-11.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-11.2
      name: Unauthorized Network Services
      description: Automated mechanisms exist to detect unauthorized network services
        and alert incident response personnel.
      annotation: Does the organization use automated mechanisms to detect unauthorized
        network services and alert incident response personnel?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-11.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-11.3
      name: Monitoring for Indicators of Compromise (IOC)
      description: Automated mechanisms exist to identify and alert on Indicators
        of Compromise (IoC).
      annotation: Does the organization use automated mechanisms to identify and alert
        on Indicators of Compromise (IoC)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-12
      name: Session Audit
      description: "Mechanisms exist to provide session audit capabilities that can:\
        \ \n(1) Capture and log all content related to a user session; and\n(2) Remotely\
        \ view all content related to an established user session in real time."
      annotation: "Does the organization provide session audit capabilities that can:\
        \ \n (1) Capture and log all content related to a user session; and\n (2)\
        \ Remotely view all content related to an established user session in real\
        \ time?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-13
      name: Alternate Event Logging Capability
      description: Mechanisms exist to provide an alternate event logging capability
        in the event of a failure in primary audit capability.
      annotation: Does the organization provide an alternate event logging capability
        in the event of a failure in primary audit capability?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-14
      name: Cross-Organizational Monitoring
      description: Mechanisms exist to coordinate sanitized event logs among external
        organizations to identify anomalous events when event logs are shared across
        organizational boundaries, without giving away sensitive or critical business
        data.
      annotation: Does the organization coordinate sanitized event logs among external
        organizations to identify anomalous events when event logs are shared across
        organizational boundaries, without giving away sensitive or critical business
        data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-14.1
      name: Sharing of Event Logs
      description: Mechanisms exist to share event logs with third-party organizations
        based on specific cross-organizational sharing agreements.
      annotation: Does the organization share event logs with third-party organizations
        based on specific cross-organizational sharing agreements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-15
      name: Covert Channel Analysis
      description: Mechanisms exist to conduct covert channel analysis to identify
        aspects of communications that are potential avenues for covert channels.
      annotation: Does the organization conduct covert channel analysis to identify
        aspects of communications that are potential avenues for covert channels?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-16
      name: Anomalous Behavior
      description: Mechanisms exist to detect and respond to anomalous behavior that
        could indicate account compromise or other malicious activities.
      annotation: Does the organization detect and respond to anomalous behavior that
        could indicate account compromise or other malicious activities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-16.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-16.1
      name: Insider Threats
      description: Mechanisms exist to monitor internal personnel activity for potential
        security incidents.
      annotation: Does the organization monitor internal personnel activity for potential
        security incidents?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-16.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-16.2
      name: Third-Party Threats
      description: Mechanisms exist to monitor third-party personnel activity for
        potential security incidents.
      annotation: Does the organization monitor third-party personnel activity for
        potential security incidents?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-16.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-16.3
      name: Unauthorized Activities
      description: Mechanisms exist to monitor for unauthorized activities, accounts,
        connections, devices and software.
      annotation: Does the organization monitor for unauthorized activities, accounts,
        connections, devices and software?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-16.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-16.4
      name: Account Creation and Modification Logging
      description: Automated mechanisms exist to generate event logs for permissions
        changes to privileged accounts and/or groups.
      annotation: Does the organization use automated mechanisms to generate event
        logs for permissions changes to privileged accounts and/or groups?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-17
      name: Event Log Analysis & Triage
      description: Mechanisms exist to ensure event log reviews include analysis and
        triage practices that integrate with the organization's established incident
        response processes.
      annotation: Does the organization ensure event log reviews include analysis
        and triage practices that integrate with its established incident response
        processes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon-17.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mon
      ref_id: MON-17.1
      name: Event Log Review Escalation Matrix
      description: Mechanisms exist to make event log review processes more efficient
        and effective by developing and maintaining an incident response escalation
        matrix.
      annotation: Does the organization make event log review processes more efficient
        and effective by developing and maintaining an incident response escalation
        matrix?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      assessable: false
      depth: 1
      ref_id: CRY
      name: Cryptographic Protections
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-01
      name: Use of Cryptographic Controls
      description: Mechanisms exist to facilitate the implementation of cryptographic
        protections controls using known public standards and trusted cryptographic
        technologies.
      annotation: Does the organization facilitate the implementation of cryptographic
        protections controls using known public standards and trusted cryptographic
        technologies?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-01.1
      name: Alternate Physical Protection
      description: Cryptographic mechanisms exist to prevent unauthorized disclosure
        of information as an alternative to physical safeguards.
      annotation: Are cryptographic mechanisms utilized to prevent unauthorized disclosure
        of information as an alternative to physical safeguards?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-01.2
      name: Export-Controlled Cryptography
      description: Mechanisms exist to address the exporting of cryptographic technologies
        in compliance with relevant statutory and regulatory requirements.
      annotation: Does the organization address the exporting of cryptographic technologies
        in compliance with relevant statutory and regulatory requirements?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-01.3
      name: Pre/Post Transmission Handling
      description: Cryptographic mechanisms exist to ensure the confidentiality and
        integrity of information during preparation for transmission and during reception.
      annotation: Are cryptographic mechanisms utilized to ensure the confidentiality
        and integrity of information during preparation for transmission and during
        reception?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-01.4
      name: Conceal / Randomize Communications
      description: Cryptographic mechanisms exist to conceal or randomize communication
        patterns.
      annotation: Are cryptographic mechanisms utilized to conceal or randomize communication
        patterns?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-01.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-01.5
      name: Cryptographic Cipher Suites and Protocols Inventory
      description: Mechanisms exist to identify, document and review deployed cryptographic
        cipher suites and protocols to proactively respond to industry trends regarding
        the continued viability of utilized cryptographic cipher suites and protocols.
      annotation: Does the organization identify, document and review deployed cryptographic
        cipher suites and protocols to proactively respond to industry trends regarding
        the continued viability of utilized cryptographic cipher suites and protocols?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-02
      name: Cryptographic Module Authentication
      description: Automated mechanisms exist to enable systems to authenticate to
        a cryptographic module.
      annotation: Does the organization use automated mechanisms to enable systems
        to authenticate to a cryptographic module?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-03
      name: Transmission Confidentiality
      description: Cryptographic mechanisms exist to protect the confidentiality of
        data being transmitted.
      annotation: Are cryptographic mechanisms utilized to protect the confidentiality
        of data being transmitted?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-04
      name: Transmission Integrity
      description: Cryptographic mechanisms exist to protect the integrity of data
        being transmitted.
      annotation: Are cryptographic mechanisms utilized to protect the integrity of
        data being transmitted?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-05
      name: Encrypting Data At Rest
      description: Cryptographic mechanisms exist to prevent unauthorized disclosure
        of data at rest.
      annotation: Are cryptographic mechanisms utilized to prevent unauthorized disclosure
        of data at rest?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-05.1
      name: Storage Media
      description: Cryptographic mechanisms exist to protect the confidentiality and
        integrity of sensitive/regulated data residing on storage media.
      annotation: Are cryptographic mechanisms utilized to protect the confidentiality
        and integrity of sensitive/regulated data residing on storage media?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-05.2
      name: Offline Storage
      description: Mechanisms exist to remove unused data from online storage and
        archive it off-line in a secure location until it can be disposed of according
        to data retention requirements.
      annotation: Does the organization remove unused data from online storage and
        archive it off-line in a secure location until it can be disposed of according
        to data retention requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-05.3
      name: Database Encryption
      description: Mechanisms exist to ensure that database servers utilize encryption
        to protect the confidentiality of the data within the databases.
      annotation: Does the organization ensure that database servers utilize encryption
        to protect the confidentiality of the data within the databases?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-06
      name: Non-Console Administrative Access
      description: Cryptographic mechanisms exist to protect the confidentiality and
        integrity of non-console administrative access.
      annotation: Are cryptographic mechanisms utilized to protect the confidentiality
        and integrity of non-console administrative access?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-07
      name: Wireless Access Authentication & Encryption
      description: Mechanisms exist to protect the confidentiality and integrity of
        wireless networking technologies by implementing authentication and strong
        encryption.
      annotation: Does the organization protect the confidentiality and integrity
        of wireless networking technologies by implementing authentication and strong
        encryption?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-08
      name: Public Key Infrastructure (PKI)
      description: Mechanisms exist to securely implement an internal Public Key Infrastructure
        (PKI) infrastructure or obtain PKI services from a reputable PKI service provider.
      annotation: Does the organization securely implement an internal Public Key
        Infrastructure (PKI) infrastructure or obtain PKI services from a reputable
        PKI service provider?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-08.1
      name: Availability
      description: Resiliency mechanisms exist to ensure the availability of data
        in the event of the loss of cryptographic keys.
      annotation: Does the organization ensure the availability of data in the event
        of the loss of cryptographic keys?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09
      name: Cryptographic Key Management
      description: Mechanisms exist to facilitate cryptographic key management controls
        to protect the confidentiality, integrity and availability of keys.
      annotation: Does the organization facilitate cryptographic key management controls
        to protect the confidentiality, integrity and availability of keys?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.1
      name: Symmetric Keys
      description: Mechanisms exist to facilitate the production and management of
        symmetric cryptographic keys using Federal Information Processing Standards
        (FIPS)-compliant key management technology and processes.
      annotation: Does the organization facilitate the production and management of
        symmetric cryptographic keys using Federal Information Processing Standards
        (FIPS)-compliant key management technology and processes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.2
      name: Asymmetric Keys
      description: "Mechanisms exist to facilitate the production and management of\
        \ asymmetric cryptographic keys using Federal Information Processing Standards\
        \ (FIPS)-compliant key management technology and processes that protect the\
        \ user\u2019s private key."
      annotation: "Does the organization facilitate the production and management\
        \ of asymmetric cryptographic keys using Federal Information Processing Standards\
        \ (FIPS)-compliant key management technology and processes that protect the\
        \ user\u2019s private key?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.3
      name: Cryptographic Key Loss or Change
      description: Mechanisms exist to ensure the availability of information in the
        event of the loss of cryptographic keys by individual users.
      annotation: Does the organization ensure the availability of information in
        the event of the loss of cryptographic keys by individual users?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.4
      name: Control & Distribution of Cryptographic Keys
      description: Mechanisms exist to facilitate the secure distribution of symmetric
        and asymmetric cryptographic keys using industry recognized key management
        technology and processes.
      annotation: Does the organization facilitate the secure distribution of symmetric
        and asymmetric cryptographic keys using industry recognized key management
        technology and processes?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.5
      name: Assigned Owners
      description: Mechanisms exist to ensure cryptographic keys are bound to individual
        identities.
      annotation: Does the organization ensure cryptographic keys are bound to individual
        identities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.6
      name: Third-Party Cryptographic Keys
      description: Mechanisms exist to ensure customers are provided with appropriate
        key management guidance whenever cryptographic keys are shared.
      annotation: Does the organization ensure customers are provided with appropriate
        key management guidance whenever cryptographic keys are shared?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-09.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-09.7
      name: External System Cryptographic Key Control
      description: Mechanisms exist to maintain control of cryptographic keys for
        encrypted material stored or transmitted through an external system.
      annotation: Does the organization maintain control of cryptographic keys for
        encrypted material stored or transmitted through an external system?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-10
      name: Transmission of Cybersecurity & Data Privacy Attributes
      description: Mechanisms exist to ensure systems associate security attributes
        with information exchanged between systems.
      annotation: Does the organization ensure systems associate security attributes
        with information exchanged between systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-11
      name: Certificate Authorities
      description: Automated mechanisms exist to enable the use of organization-defined
        Certificate Authorities (CAs) to facilitate the establishment of protected
        sessions.
      annotation: Does the organization use automated mechanisms to enable the use
        of organization-defined Certificate Authorities (CAs) to facilitate the establishment
        of protected sessions?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:cry
      ref_id: CRY-12
      name: Certificate Monitoring
      description: Automated mechanisms exist to discover when new certificates are
        issued for organization-controlled domains.
      annotation: Does the organization use automated mechanisms to discover when
        new certificates are issued for organization-controlled domains?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      assessable: false
      depth: 1
      ref_id: DCH
      name: Data Classification & Handling
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-01
      name: Data Protection
      description: Mechanisms exist to facilitate the implementation of data protection
        controls.
      annotation: Does the organization facilitate the implementation of data protection
        controls?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-01.1
      name: Data Stewardship
      description: Mechanisms exist to ensure data stewardship is assigned, documented
        and communicated.
      annotation: Does the organization ensure data stewardship is assigned, documented
        and communicated?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-01.2
      name: Sensitive / Regulated Data Protection
      description: Mechanisms exist to protect sensitive/regulated data wherever it
        is stored.
      annotation: Does the organization protect sensitive/regulated data wherever
        it is stored?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-01.3
      name: Sensitive / Regulated Media Records
      description: Mechanisms exist to ensure media records for sensitive/regulated
        data contain sufficient information to determine the potential impact in the
        event of a data loss incident.
      annotation: Does the organization ensure media records for sensitive/regulated
        data contain sufficient information to determine the potential impact in the
        event of a data loss incident?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-01.4
      name: Defining Access Authorizations for Sensitive/Regulated Data
      description: Mechanisms exist to explicitly define authorizations for specific
        individuals and/or roles for logical and /or physical access to sensitive/regulated
        data.
      annotation: Does the organization explicitly define authorizations for specific
        individuals and/or roles for logical and /or physical access to sensitive/regulated
        data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-02
      name: Data & Asset Classification
      description: Mechanisms exist to ensure data and assets are categorized in accordance
        with applicable statutory, regulatory and contractual requirements.
      annotation: Does the organization ensure data and assets are categorized in
        accordance with applicable statutory, regulatory and contractual requirements?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-02.1
      name: Highest Classification Level
      description: Mechanisms exist to ensure that systems, applications and services
        are classified according to the highest level of data sensitivity that is
        stored, transmitted and/or processed.
      annotation: Does the organization ensure that systems, applications and services
        are classified according to the highest level of data sensitivity that is
        stored, transmitted and/or processed?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-03
      name: Media Access
      description: Mechanisms exist to control and restrict access to digital and
        non-digital media to authorized individuals.
      annotation: Does the organization control and restrict access to digital and
        non-digital media to authorized individuals?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-03.1
      name: Disclosure of Information
      description: Mechanisms exist to restrict the disclosure of sensitive / regulated
        data to authorized parties with a need to know.
      annotation: Does the organization restrict the disclosure of sensitive / regulated
        data to authorized parties with a need to know?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-03.2
      name: Masking Displayed Data
      description: Mechanisms exist to apply data masking to sensitive/regulated information
        that is displayed or printed.
      annotation: Does the organization apply data masking to sensitive/regulated
        information that is displayed or printed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-03.3
      name: Controlled Release
      description: Automated mechanisms exist to validate cybersecurity & data privacy
        attributes prior to releasing information to external systems.
      annotation: Does the organization use automated mechanisms to validate cybersecurity
        & data privacy attributes prior to releasing information to external systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-04
      name: Media Marking
      description: Mechanisms exist to mark media in accordance with data protection
        requirements so that personnel are alerted to distribution limitations, handling
        caveats and applicable security requirements.
      annotation: Does the organization mark media in accordance with data protection
        requirements so that personnel are alerted to distribution limitations, handling
        caveats and applicable security requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-04.1
      name: Automated Marking
      description: Automated mechanisms exist to mark physical media and digital files
        to indicate the distribution limitations, handling requirements and applicable
        security markings (if any) of the information to aid Data Loss Prevention
        (DLP) technologies.
      annotation: Does the organization use automated mechanisms to mark physical
        media and digital files to indicate the distribution limitations, handling
        requirements and applicable security markings (if any) of the information
        to aid Data Loss Prevention (DLP) technologies?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05
      name: Cybersecurity & Data Privacy Attributes
      description: Mechanisms exist to bind cybersecurity & data privacy attributes
        to information as it is stored, transmitted and processed.
      annotation: Does the organization bind cybersecurity & data privacy attributes
        to information as it is stored, transmitted and processed?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.1
      name: Dynamic Attribute Association
      description: Mechanisms exist to dynamically associate cybersecurity & data
        privacy attributes with individuals and objects as information is created,
        combined, or transformed, in accordance with organization-defined cybersecurity
        and data privacy policies.
      annotation: Does the organization dynamically associate cybersecurity & data
        privacy attributes with individuals and objects as information is created,
        combined, or transformed, in accordance with organization-defined cybersecurity
        and data privacy policies?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.2
      name: Attribute Value Changes By Authorized Individuals
      description: Mechanisms exist to provide authorized individuals (or processes
        acting on behalf of individuals) the capability to define or change the value
        of associated cybersecurity & data privacy attributes.
      annotation: Does the organization provide authorized individuals (or processes
        acting on behalf of individuals) the capability to define or change the value
        of associated cybersecurity & data privacy attributes?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.3
      name: Maintenance of Attribute Associations By System
      description: Mechanisms exist to maintain the association and integrity of cybersecurity
        & data privacy attributes to individuals and objects.
      annotation: Does the organization maintain the association and integrity of
        cybersecurity & data privacy attributes to individuals and objects?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.4
      name: Association of Attributes By Authorized Individuals
      description: Mechanisms exist to provide the capability to associate cybersecurity
        & data privacy attributes with individuals and objects by authorized individuals
        (or processes acting on behalf of individuals).
      annotation: Does the organization provide the capability to associate cybersecurity
        & data privacy attributes with individuals and objects by authorized individuals
        (or processes acting on behalf of individuals)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.5
      name: Attribute Displays for Output Devices
      description: Mechanisms exist to display cybersecurity & data privacy attributes
        in human-readable form on each object that the system transmits to output
        devices to identify special dissemination, handling or distribution instructions
        using human-readable, standard naming conventions.
      annotation: Does the organization display cybersecurity & data privacy attributes
        in human-readable form on each object that the system transmits to output
        devices to identify special dissemination, handling or distribution instructions
        using human-readable, standard naming conventions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.6
      name: Data Subject Attribute Associations
      description: Mechanisms exist to require personnel to associate and maintain
        the association of cybersecurity & data privacy attributes with individuals
        and objects in accordance with cybersecurity and data privacy policies.
      annotation: Does the organization require personnel to associate and maintain
        the association of cybersecurity & data privacy attributes with individuals
        and objects in accordance with cybersecurity and data privacy policies?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.7
      name: Consistent Attribute Interpretation
      description: Mechanisms exist to provide a consistent, organizationally agreed
        upon interpretation of cybersecurity & data privacy attributes employed in
        access enforcement and flow enforcement decisions between distributed system
        components.
      annotation: Does the organization provide a consistent, organizationally agreed
        upon interpretation of cybersecurity & data privacy attributes employed in
        access enforcement and flow enforcement decisions between distributed system
        components?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.8
      name: Identity Association Techniques & Technologies
      description: Mechanisms exist to associate cybersecurity & data privacy attributes
        to information.
      annotation: Does the organization associate cybersecurity & data privacy attributes
        to information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.9
      name: Attribute Reassignment
      description: Mechanisms exist to reclassify data as required, due to changing
        business/technical requirements.
      annotation: Does the organization reclassify data as required, due to changing
        business/technical requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.10
      name: Attribute Configuration By Authorized Individuals
      description: Mechanisms exist to provide authorized individuals the capability
        to define or change the type and value of cybersecurity & data privacy attributes
        available for association with subjects and objects.
      annotation: Does the organization provide authorized individuals the capability
        to define or change the type and value of cybersecurity & data privacy attributes
        available for association with subjects and objects?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-05.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-05.11
      name: Audit Changes
      description: Mechanisms exist to audit changes to cybersecurity & data privacy
        attributes and responds to events in accordance with incident response procedures.
      annotation: Does the organization audit changes to cybersecurity & data privacy
        attributes and responds to events in accordance with incident response procedures?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-06
      name: Media Storage
      description: "Mechanisms exist to: \n(1) Physically control and securely store\
        \ digital and non-digital media within controlled areas using organization-defined\
        \ security measures; and\n(2) Protect system media until the media are destroyed\
        \ or sanitized using approved equipment, techniques and procedures."
      annotation: "Does the organization: \n (1) Physically control and securely store\
        \ digital and non-digital media within controlled areas using organization-defined\
        \ security measures; and\n (2) Protect system media until the media are destroyed\
        \ or sanitized using approved equipment, techniques and procedures?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-06.1
      name: Physically Secure All Media
      description: Mechanisms exist to physically secure all media that contains sensitive
        information.
      annotation: Does the organization physically secure all media that contains
        sensitive information?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-06.2
      name: Sensitive Data Inventories
      description: Mechanisms exist to maintain inventory logs of all sensitive media
        and conduct sensitive media inventories at least annually.
      annotation: Does the organization maintain inventory logs of all sensitive media
        and conduct sensitive media inventories at least annually?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-06.3
      name: Periodic Scans for Sensitive / Regulated Data
      description: Mechanisms exist to periodically scan unstructured data sources
        for sensitive/regulated data or data requiring special protection measures
        by statutory, regulatory or contractual obligations.
      annotation: Does the organization periodically scan unstructured data sources
        for sensitive/regulated data or data requiring special protection measures
        by statutory, regulatory or contractual obligations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-06.4
      name: Making Sensitive Data Unreadable In Storage
      description: Mechanisms exist to ensure sensitive/regulated data is rendered
        human unreadable anywhere sensitive/regulated data is stored.
      annotation: Does the organization ensure sensitive/regulated data is rendered
        human unreadable anywhere sensitive/regulated data is stored?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-06.5
      name: Storing Authentication Data
      description: Mechanisms exist to prohibit the storage of sensitive transaction
        authentication data after authorization.
      annotation: Does the organization prohibit the storage of sensitive transaction
        authentication data after authorization?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-07
      name: Media Transportation
      description: Mechanisms exist to protect and control digital and non-digital
        media during transport outside of controlled areas using appropriate security
        measures.
      annotation: Does the organization protect and control digital and non-digital
        media during transport outside of controlled areas using appropriate security
        measures?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-07.1
      name: Custodians
      description: Mechanisms exist to identify custodians throughout the transport
        of digital or non-digital media.
      annotation: Does the organization identify custodians throughout the transport
        of digital or non-digital media?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-07.2
      name: Encrypting Data In Storage Media
      description: Cryptographic mechanisms exist to protect the confidentiality and
        integrity of information stored on digital media during transport outside
        of controlled areas.
      annotation: Are cryptographic mechanisms utilized to protect the confidentiality
        and integrity of information stored on digital media during transport outside
        of controlled areas?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-08
      name: Physical Media Disposal
      description: Mechanisms exist to securely dispose of media when it is no longer
        required, using formal procedures.
      annotation: Does the organization securely dispose of media when it is no longer
        required, using formal procedures?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-09
      name: System Media Sanitization
      description: Mechanisms exist to sanitize system media with the strength and
        integrity commensurate with the classification or sensitivity of the information
        prior to disposal, release out of organizational control or release for reuse.
      annotation: Does the organization sanitize system media with the strength and
        integrity commensurate with the classification or sensitivity of the information
        prior to disposal, release out of organizational control or release for reuse?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-09.1
      name: System Media Sanitization Documentation
      description: Mechanisms exist to supervise, track, document and verify system
        media sanitization and disposal actions.
      annotation: Does the organization supervise, track, document and verify system
        media sanitization and disposal actions?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-09.2
      name: Equipment Testing
      description: Mechanisms exist to test sanitization equipment and procedures
        to verify that the intended result is achieved.
      annotation: Does the organization test sanitization equipment and procedures
        to verify that the intended result is achieved?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-09.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-09.3
      name: Sanitization of Personal Data (PD)
      description: Mechanisms exist to facilitate the sanitization of Personal Data
        (PD).
      annotation: Does the organization facilitate the sanitization of Personal Data
        (PD)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-09.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-09.4
      name: First Time Use Sanitization
      description: Mechanisms exist to apply nondestructive sanitization techniques
        to portable storage devices prior to first use.
      annotation: Does the organization apply nondestructive sanitization techniques
        to portable storage devices prior to first use?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-09.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-09.5
      name: Dual Authorization for Sensitive Data Destruction
      description: Mechanisms exist to enforce dual authorization for the destruction,
        disposal or sanitization of digital media that contains sensitive / regulated
        data.
      annotation: Does the organization enforce dual authorization for the destruction,
        disposal or sanitization of digital media that contains sensitive / regulated
        data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-10
      name: Media Use
      description: Mechanisms exist to restrict the use of types of digital media
        on systems or system components.
      annotation: Does the organization restrict the use of types of digital media
        on systems or system components?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-10.1
      name: Limitations on Use
      description: Mechanisms exist to restrict the use and distribution of sensitive
        / regulated data.
      annotation: Does the organization restrict the use and distribution of sensitive
        / regulated data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-10.2
      name: Prohibit Use Without Owner
      description: Mechanisms exist to prohibit the use of portable storage devices
        in organizational information systems when such devices have no identifiable
        owner.
      annotation: Does the organization prohibit the use of portable storage devices
        in organizational information systems when such devices have no identifiable
        owner?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-11
      name: Data Reclassification
      description: Mechanisms exist to reclassify data, including associated systems,
        applications and services, commensurate with the security category and/or
        classification level of the information.
      annotation: Does the organization reclassify data, including associated systems,
        applications and services, commensurate with the security category and/or
        classification level of the information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-12
      name: Removable Media Security
      description: Mechanisms exist to restrict removable media in accordance with
        data handling and acceptable usage parameters.
      annotation: Does the organization restrict removable media in accordance with
        data handling and acceptable usage parameters?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-13
      name: Use of External Information Systems
      description: Mechanisms exist to govern how external parties, systems and services
        are used to securely store, process and transmit data.
      annotation: Does the organization govern how external parties, systems and services
        are used to securely store, process and transmit data?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-13.1
      name: Limits of Authorized Use
      description: "Mechanisms exist to prohibit external parties, systems and services\
        \ from storing, processing and transmitting data unless authorized individuals\
        \ first: \n(1) Verifying the implementation of required security controls;\
        \ or\n(2) Retaining a processing agreement with the entity hosting the external\
        \ systems or service."
      annotation: "Does the organization prohibit external parties, systems and services\
        \ from storing, processing and transmitting data unless authorized individuals\
        \ first: \n (1) Verifying the implementation of required security controls;\
        \ or\n (2) Retaining a processing agreement with the entity hosting the external\
        \ systems or service?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-13.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-13.2
      name: Portable Storage Devices
      description: Mechanisms exist to restrict or prohibit the use of portable storage
        devices by users on external systems.
      annotation: Does the organization restrict or prohibit the use of portable storage
        devices by users on external systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-13.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-13.3
      name: Protecting Sensitive Data on External Systems
      description: Mechanisms exist to ensure that the requirements for the protection
        of sensitive information processed, stored or transmitted on external systems,
        are implemented in accordance with applicable statutory, regulatory and contractual
        obligations.
      annotation: Does the organization ensure that the requirements for the protection
        of sensitive information processed, stored or transmitted on external systems,
        are implemented in accordance with applicable statutory, regulatory and contractual
        obligations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-13.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-13.4
      name: Non-Organizationally Owned Systems / Components / Devices
      description: Mechanisms exist to restrict the use of non-organizationally owned
        information systems, system components or devices to process, store or transmit
        organizational information.
      annotation: Does the organization restrict the use of non-organizationally owned
        information systems, system components or devices to process, store or transmit
        organizational information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-14
      name: Information Sharing
      description: Mechanisms exist to utilize a process to assist users in making
        information sharing decisions to ensure data is appropriately protected.
      annotation: Does the organization utilize a process to assist users in making
        information sharing decisions to ensure data is appropriately protected?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-14.1
      name: Information Search & Retrieval
      description: Mechanisms exist to ensure information systems implement data search
        and retrieval functions that properly enforce data protection / sharing restrictions.
      annotation: Does the organization ensure information systems implement data
        search and retrieval functions that properly enforce data protection / sharing
        restrictions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-14.2
      name: Transfer Authorizations
      description: Mechanisms exist to verify that individuals or systems transferring
        data between interconnecting systems have the requisite authorizations (e.g.,
        write permissions or privileges) prior to transferring said data.
      annotation: Does the organization verify that individuals or systems transferring
        data between interconnecting systems have the requisite authorizations (e.g.,
        write permissions or privileges) prior to transferring said data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-14.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-14.3
      name: Data Access Mapping
      description: Mechanisms exist to leverage data-specific Access Control Lists
        (ACL) or Interconnection Security Agreements (ISAs) to generate a logical
        map of the parties with whom sensitive/regulated data is shared.
      annotation: Does the organization leverage data-specific Access Control Lists
        (ACL) or Interconnection Security Agreements (ISAs) to generate a logical
        map of the parties with whom sensitive/regulated data is shared?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-15
      name: Publicly Accessible Content
      description: Mechanisms exist to control publicly-accessible content.
      annotation: Does the organization control publicly-accessible content?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-16
      name: Data Mining Protection
      description: Mechanisms exist to protect data storage objects against unauthorized
        data mining and data harvesting techniques.
      annotation: Does the organization protect data storage objects against unauthorized
        data mining and data harvesting techniques?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-17
      name: Ad-Hoc Transfers
      description: Mechanisms exist to secure ad-hoc exchanges of large digital files
        with internal or external parties.
      annotation: Does the organization secure ad-hoc exchanges of large digital files
        with internal or external parties?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-18
      name: Media & Data Retention
      description: Mechanisms exist to retain media and data in accordance with applicable
        statutory, regulatory and contractual obligations.
      annotation: Does the organization retain media and data in accordance with applicable
        statutory, regulatory and contractual obligations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-18.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-18.1
      name: Minimize Sensitive / Regulated Data
      description: Mechanisms exist to minimize sensitive/regulated data that is collected,
        received, processed, stored and/or transmitted throughout the information
        lifecycle to only those elements necessary to support necessary business processes.
      annotation: Does the organization minimize sensitive/regulated data that is
        collected, received, processed, stored and/or transmitted throughout the information
        lifecycle to only those elements necessary to support necessary business processes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-18.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-18.2
      name: Limit Sensitive / Regulated Data In Testing, Training & Research
      description: Mechanisms exist to minimize the use of sensitive/regulated data
        for research, testing, or training, in accordance with authorized, legitimate
        business practices.
      annotation: Does the organization minimize the use of Personal Data (PD) for
        research, testing, or training, in accordance with the Data Protection Impact
        Assessment (DPIA)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-18.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-18.3
      name: Temporary Files Containing Personal Data (PD)
      description: Mechanisms exist to perform periodic checks of temporary files
        for the existence of Personal Data (PD).
      annotation: Does the organization perform periodic checks of temporary files
        for the existence of Personal Data (PD)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-19
      name: Geographic Location of Data
      description: Mechanisms exist to inventory, document and maintain data flows
        for data that is resident (permanently or temporarily) within a service's
        geographically distributed applications (physical and virtual), infrastructure,
        systems components and/or shared with other third-parties.
      annotation: Does the organization inventory, document and maintain data flows
        for data that is resident (permanently or temporarily) within a service's
        geographically distributed applications (physical and virtual), infrastructure,
        systems components and/or shared with other third-parties?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-20
      name: Archived Data Sets
      description: Mechanisms exist to protect archived data in accordance with applicable
        statutory, regulatory and contractual obligations.
      annotation: Does the organization protect archived data in accordance with applicable
        statutory, regulatory and contractual obligations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-21
      name: Information Disposal
      description: Mechanisms exist to securely dispose of, destroy or erase information.
      annotation: Does the organization securely dispose of, destroy or erase information?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-22
      name: Data Quality Operations
      description: Mechanisms exist to check for Redundant, Obsolete/Outdated, Toxic
        or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact,
        completeness and de-identification of information throughout the information
        lifecycle.
      annotation: Does the organization check for Redundant, Obsolete/Outdated, Toxic
        or Trivial (ROTT) data to ensure the accuracy, relevance, timeliness, impact,
        completeness and de-identification of information throughout the information
        lifecycle.
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-22.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-22.1
      name: Updating & Correcting Personal Data (PD)
      description: Mechanisms exist to utilize technical controls to correct Personal
        Data (PD) that is inaccurate or outdated, incorrectly determined regarding
        impact, or incorrectly de-identified.
      annotation: Does the organization utilize technical controls to correct Personal
        Data (PD) that is inaccurate or outdated, incorrectly determined regarding
        impact, or incorrectly de-identified?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-22.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-22.2
      name: Data Tags
      description: Mechanisms exist to utilize data tags to automate tracking of sensitive/regulated
        data across the information lifecycle.
      annotation: Does the organization utilize data tags to automate tracking of
        sensitive/regulated data across the information lifecycle?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-22.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-22.3
      name: Primary Source Personal Data (PD) Collection
      description: Mechanisms exist to collect Personal Data (PD) directly from the
        individual.
      annotation: Does the organization collect Personal Data (PD) directly from the
        individual?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23
      name: De-Identification (Anonymization)
      description: Mechanisms exist to anonymize data by removing Personal Data (PD)
        from datasets.
      annotation: Does the organization anonymize data by removing Personal Data (PD)
        from datasets?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.1
      name: De-Identify Dataset Upon Collection
      description: Mechanisms exist to de-identify the dataset upon collection by
        not collecting Personal Data (PD).
      annotation: Does the organization de-identify the dataset upon collection by
        not collecting Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.2
      name: Archiving
      description: Mechanisms exist to refrain from archiving Personal Data (PD) elements
        if those elements in a dataset will not be needed after the dataset is archived.
      annotation: Does the organization refrain from archiving Personal Data (PD)
        elements if those elements in a dataset will not be needed after the dataset
        is archived?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.3
      name: Release
      description: Mechanisms exist to remove Personal Data (PD) elements from a dataset
        prior to its release if those elements in the dataset do not need to be part
        of the data release.
      annotation: Does the organization remove Personal Data (PD) elements from a
        dataset prior to its release if those elements in the dataset do not need
        to be part of the data release?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.4
      name: Removal, Masking, Encryption, Hashing or Replacement of Direct Identifiers
      description: Mechanisms exist to remove, mask, encrypt, hash or replace direct
        identifiers in a dataset.
      annotation: Does the organization remove, mask, encrypt, hash or replace direct
        identifiers in a dataset?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.5
      name: Statistical Disclosure Control
      description: Mechanisms exist to manipulate numerical data, contingency tables
        and statistical findings so that no person or organization is identifiable
        in the results of the analysis.
      annotation: Does the organization manipulate numerical data, contingency tables
        and statistical findings so that no person or organization is identifiable
        in the results of the analysis?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.6
      name: Differential Data Privacy
      description: Mechanisms exist to prevent disclosure of Personal Data (PD) by
        adding non-deterministic noise to the results of mathematical operations before
        the results are reported.
      annotation: Does the organization prevent disclosure of Personal Data (PD) by
        adding non-deterministic noise to the results of mathematical operations before
        the results are reported?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.7
      name: Automated De-Identification of Sensitive Data
      description: Mechanisms exist to perform de-identification of sensitive/regulated
        data, using validated algorithms and software to implement the algorithms.
      annotation: Does the organization perform de-identification of sensitive/regulated
        data, using validated algorithms and software to implement the algorithms?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.8
      name: Motivated Intruder
      description: Mechanisms exist to perform a motivated intruder test on the de-identified
        dataset to determine if the identified data remains or if the de-identified
        data can be re-identified.
      annotation: Does the organization perform a motivated intruder test on the de-identified
        dataset to determine if the identified data remains or if the de-identified
        data can be re-identified?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-23.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-23.9
      name: Code Names
      description: Mechanisms exist to use aliases to name assets, which are mission-critical
        and/or contain highly-sensitive/regulated data, are unique and not readily
        associated with a product, project or type of data.
      annotation: Does the organization use aliases to name assets, which are mission-critical
        and/or contain highly-sensitive/regulated data, are unique and not readily
        associated with a product, project or type of data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-24
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-24
      name: Information Location
      description: Mechanisms exist to identify and document the location of information
        and the specific system components on which the information resides.
      annotation: Does the organization identify and document the location of information
        and the specific system components on which the information resides?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-24.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-24.1
      name: Automated Tools to Support Information Location
      description: Automated mechanisms exist to identify by data classification type
        to ensure adequate cybersecurity & data privacy controls are in place to protect
        organizational information and individual data privacy.
      annotation: Does the organization use automated mechanisms to identify by data
        classification type to ensure adequate cybersecurity & data privacy controls
        are in place to protect organizational information and individual data privacy?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-25
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-25
      name: Transfer of Sensitive and/or Regulated Data
      description: Mechanisms exist to restrict and govern the transfer of sensitive
        and/or regulated data to third-countries or international organizations.
      annotation: Does the organization restrict and govern the transfer of sensitive
        and/or regulated data to third-countries or international organizations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-25.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-25.1
      name: Transfer Activity Limits
      description: Mechanisms exist to establish organization-defined "normal business
        activities" to identify anomalous transaction activities that can reduce the
        opportunity for sending (outbound) and/or receiving (inbound) fraudulent actions.
      annotation: Does the organization establish organization-defined "normal business
        activities" to identify anomalous transaction activities that can reduce the
        opportunity for sending (outbound) and/or receiving (inbound) fraudulent actions?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-26
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-26
      name: Data Localization
      description: Mechanisms exist to constrain the impact of "digital sovereignty
        laws," that require localized data within the host country, where data and
        processes may be subjected to arbitrary enforcement actions that potentially
        violate other applicable statutory, regulatory and/or contractual obligations.
      annotation: Does the organization constrain the impact of "digital sovereignty
        laws," that require localized data within the host country, where data and
        processes may be subjected to arbitrary enforcement actions that potentially
        violate other applicable statutory, regulatory and/or contractual obligations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch-27
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:dch
      ref_id: DCH-27
      name: Data Rights Management (DRM)
      description: Mechanisms exist to utilize Data Rights Management (DRM), or similar
        technologies, to protect Intellectual Property (IP) rights by preventing the
        unauthorized distribution and/or modification of sensitive IP.
      annotation: Does the organization utilize Data Rights Management (DRM), or similar
        technologies, to protect Intellectual Property (IP) rights by preventing the
        unauthorized distribution and/or modification of sensitive IP?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      assessable: false
      depth: 1
      ref_id: EMB
      name: Embedded Technology
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-01
      name: Embedded Technology Security Program
      description: Mechanisms exist to facilitate the implementation of embedded technology
        controls.
      annotation: Does the organization facilitate the implementation of embedded
        technology controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-02
      name: Internet of Things (IOT)
      description: Mechanisms exist to proactively manage the cybersecurity & data
        privacy risks associated with Internet of Things (IoT).
      annotation: Does the organization proactively manage the cybersecurity & data
        privacy risks associated with Internet of Things (IoT)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-03
      name: Operational Technology (OT)
      description: Mechanisms exist to proactively manage the cybersecurity & data
        privacy risks associated with Operational Technology (OT).
      annotation: Does the organization proactively manage the cybersecurity & data
        privacy risks associated with Operational Technology (OT)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-04
      name: Interface Security
      description: Mechanisms exist to protect embedded devices against unauthorized
        use of the physical factory diagnostic and test interface(s).
      annotation: Does the organization protect embedded devices against unauthorized
        use of the physical factory diagnostic and test interface(s)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-05
      name: Embedded Technology Configuration Monitoring
      description: Mechanisms exist to generate log entries on embedded devices when
        configuration changes or attempts to access interfaces are detected.
      annotation: Does the organization generate log entries on embedded devices when
        configuration changes or attempts to access interfaces are detected?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-06
      name: Prevent Alterations
      description: Mechanisms exist to protect embedded devices by preventing the
        unauthorized installation and execution of software.
      annotation: Does the organization protect embedded devices by preventing the
        unauthorized installation and execution of software?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-07
      name: Embedded Technology Maintenance
      description: Mechanisms exist to securely update software and upgrade functionality
        on embedded devices.
      annotation: Does the organization securely update software and upgrade functionality
        on embedded devices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-08
      name: Resilience To Outages
      description: Mechanisms exist to configure embedded technology to be resilient
        to data network and power outages.
      annotation: Does the organization configure embedded technology to be resilient
        to data network and power outages?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-09
      name: Power Level Monitoring
      description: Automated mechanisms exist to monitor the power levels of embedded
        technologies for decreased or excessive power usage, including battery drainage,
        to investigate for device tampering.
      annotation: Does the organization use automated mechanisms to monitor the power
        levels of embedded technologies for decreased or excessive power usage, including
        battery drainage, to investigate for device tampering?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-10
      name: Embedded Technology Reviews
      description: Mechanisms exist to perform evaluations of deployed embedded technologies
        as needed, or at least on an annual basis, to ensure that necessary updates
        to mitigate the risks associated with legacy embedded technologies are identified
        and implemented.
      annotation: Does the organization perform evaluations of deployed embedded technologies
        as needed, or at least on an annual basis, to ensure that necessary updates
        to mitigate the risks associated with legacy embedded technologies are identified
        and implemented?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-11
      name: Message Queuing Telemetry Transport (MQTT) Security
      description: Mechanisms exist to enforce the security of Message Queuing Telemetry
        Transport (MQTT) traffic.
      annotation: Does the organization enforce the security of Message Queuing Telemetry
        Transport (MQTT) traffic?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-12
      name: Restrict Communications
      description: Mechanisms exist to require embedded technologies to initiate all
        communications and drop new, incoming communications.
      annotation: Does the organization require embedded technologies to initiate
        all communications and drop new, incoming communications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-13
      name: Authorized Communications
      description: Mechanisms exist to restrict embedded technologies to communicate
        only with authorized peers and service endpoints.
      annotation: Does the organization restrict embedded technologies to communicate
        only with authorized peers and service endpoints?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-14
      name: Operating Environment Certification
      description: Mechanisms exist to determine if embedded technologies are certified
        for secure use in the proposed operating environment.
      annotation: Does the organization determine if embedded technologies are certified
        for secure use in the proposed operating environment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-15
      name: Safety Assessment
      description: Mechanisms exist to evaluate the safety aspects of embedded technologies
        via a fault tree analysis, or similar method, to determine possible consequences
        of misuse, misconfiguration and/or failure.
      annotation: Does the organization evaluate the safety aspects of embedded technologies
        via a fault tree analysis, or similar method, to determine possible consequences
        of misuse, misconfiguration and/or failure?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-16
      name: Certificate-Based Authentication
      description: Mechanisms exist to enforce certificate-based authentication for
        embedded technologies (e.g., IoT, OT, etc.) and their supporting services.
      annotation: Does the organization enforce certificate-based authentication for
        embedded technologies (e.g., IoT, OT, etc.) and their supporting services?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-17
      name: Chip-To-Cloud Security
      description: Mechanisms exist to implement embedded technologies that utilize
        pre-provisioned cloud trust anchors to support secure bootstrap and Zero Touch
        Provisioning (ZTP).
      annotation: Does the organization implement embedded technologies that utilize
        pre-provisioned cloud trust anchors to support secure bootstrap and Zero Touch
        Provisioning (ZTP)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-18
      name: Real-Time Operating System (RTOS) Security
      description: Mechanisms exist to ensure embedded technologies utilize a securely
        configured Real-Time Operating System (RTOS).
      annotation: Does the organization ensure embedded technologies utilize a securely
        configured Real-Time Operating System (RTOS)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:emb
      ref_id: EMB-19
      name: Safe Operations
      description: Mechanisms exist to continuously validate autonomous systems that
        trigger an automatic state change when safe operation is no longer assured.
      annotation: Does the organization continuously validate autonomous systems that
        trigger an automatic state change when safe operation is no longer assured?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      assessable: false
      depth: 1
      ref_id: END
      name: Endpoint Security
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-01
      name: Endpoint Security
      description: Mechanisms exist to facilitate the implementation of endpoint security
        controls.
      annotation: Does the organization facilitate the implementation of endpoint
        security controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-02
      name: Endpoint Protection Measures
      description: Mechanisms exist to protect the confidentiality, integrity, availability
        and safety of endpoint devices.
      annotation: Does the organization protect the confidentiality, integrity, availability
        and safety of endpoint devices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-03
      name: Prohibit Installation Without Privileged Status
      description: Automated mechanisms exist to prohibit software installations without
        explicitly assigned privileged status.
      annotation: Does the organization use automated mechanisms to prohibit software
        installations without explicitly assigned privileged status?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-03.1
      name: Software Installation Alerts
      description: Mechanisms exist to generate an alert when new software is detected.
      annotation: Does the organization generate an alert when new software is detected?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-03.2
      name: Governing Access Restriction for Change
      description: Mechanisms exist to define, document, approve and enforce access
        restrictions associated with changes to systems.
      annotation: Does the organization define, document, approve and enforce access
        restrictions associated with changes to systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04
      name: Malicious Code Protection (Anti-Malware)
      description: Mechanisms exist to utilize antimalware technologies to detect
        and eradicate malicious code.
      annotation: Does the organization utilize antimalware technologies to detect
        and eradicate malicious code?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.1
      name: Automatic Antimalware Signature Updates
      description: Mechanisms exist to automatically update antimalware technologies,
        including signature definitions.
      annotation: Does the organization automatically update antimalware technologies,
        including signature definitions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.2
      name: Documented Protection Measures
      description: Mechanisms exist to document antimalware technologies.
      annotation: Does the organization document antimalware technologies?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.3
      name: Centralized Management of Antimalware Technologies
      description: Mechanisms exist to centrally-manage antimalware technologies.
      annotation: Does the organization centrally-manage antimalware technologies?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.4
      name: Heuristic / Nonsignature-Based Detection
      description: Mechanisms exist to utilize heuristic / nonsignature-based antimalware
        detection capabilities.
      annotation: Does the organization utilize heuristic / nonsignature-based antimalware
        detection capabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.5
      name: Malware Protection Mechanism Testing
      description: Mechanisms exist to test antimalware technologies by introducing
        a known benign, non-spreading test case into the system and subsequently verifying
        that both detection of the test case and associated incident reporting occurs.
      annotation: Does the organization test antimalware technologies by introducing
        a known benign, non-spreading test case into the system and subsequently verifying
        that both detection of the test case and associated incident reporting occurs?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.6
      name: Evolving Malware Threats
      description: Mechanisms exist to perform periodic evaluations evolving malware
        threats to assess systems that are generally not considered to be commonly
        affected by malicious software.
      annotation: Does the organization perform periodic evaluations evolving malware
        threats to assess systems that are generally not considered to be commonly
        affected by malicious software?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-04.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-04.7
      name: Always On Protection
      description: Mechanisms exist to ensure that anti-malware technologies are continuously
        running in real-time and cannot be disabled or altered by non-privileged users,
        unless specifically authorized by management on a case-by-case basis for a
        limited time period.
      annotation: Does the organization ensure that anti-malware technologies are
        continuously running in real-time and cannot be disabled or altered by non-privileged
        users, unless specifically authorized by management on a case-by-case basis
        for a limited time period?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-05
      name: Software Firewall
      description: Mechanisms exist to utilize host-based firewall software, or a
        similar technology, on all information systems, where technically feasible.
      annotation: Does the organization utilize host-based firewall software, or a
        similar technology, on all information systems, where technically feasible?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06
      name: Endpoint File Integrity Monitoring (FIM)
      description: Mechanisms exist to utilize File Integrity Monitor (FIM), or similar
        technologies, to detect and report on unauthorized changes to selected files
        and configuration settings.
      annotation: Does the organization utilize File Integrity Monitor (FIM), or similar
        technologies, to detect and report on unauthorized changes to selected files
        and configuration settings?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.1
      name: Integrity Checks
      description: Mechanisms exist to validate configurations through integrity checking
        of software and firmware.
      annotation: Does the organization validate configurations through integrity
        checking of software and firmware?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.2
      name: Endpoint Detection & Response (EDR)
      description: Mechanisms exist to detect and respond to unauthorized configuration
        changes as cybersecurity incidents.
      annotation: Does the organization detect and respond to unauthorized configuration
        changes as cybersecurity incidents?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.3
      name: Automated Notifications of Integrity Violations
      description: Automated mechanisms exist to alert incident response personnel
        upon discovering discrepancies during integrity verification.
      annotation: Does the organization use automated mechanisms to alert incident
        response personnel upon discovering discrepancies during integrity verification?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.4
      name: Automated Response to Integrity Violations
      description: Automated mechanisms exist to implement remediation actions when
        integrity violations are discovered.
      annotation: Does the organization use automated mechanisms to implement remediation
        actions when integrity violations are discovered?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.5
      name: Boot Process Integrity
      description: Automated mechanisms exist to verify the integrity of the boot
        process of information systems.
      annotation: Does the organization use automated mechanisms to verify the integrity
        of the boot process of information systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.6
      name: Protection of Boot Firmware
      description: Automated mechanisms exist to protect the integrity of boot firmware
        in information systems.
      annotation: Does the organization use automated mechanisms to protect the integrity
        of boot firmware in information systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-06.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-06.7
      name: Binary or Machine-Executable Code
      description: Mechanisms exist to prohibit the use of binary or machine-executable
        code from sources with limited or no warranty and without access to source
        code.
      annotation: Does the organization prohibit the use of binary or machine-executable
        code from sources with limited or no warranty and without access to source
        code?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-07
      name: Host Intrusion Detection and Prevention Systems (HIDS / HIPS)
      description: Mechanisms exist to utilize Host-based Intrusion Detection / Prevention
        Systems (HIDS / HIPS), or similar technologies, to monitor for and protect
        against anomalous host activity, including lateral movement across the network.
      annotation: Does the organization utilize Host-based Intrusion Detection / Prevention
        Systems (HIDS / HIPS), or similar technologies, to monitor for and protect
        against anomalous host activity, including lateral movement across the network?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-08
      name: Phishing & Spam Protection
      description: Mechanisms exist to utilize anti-phishing and spam protection technologies
        to detect and take action on unsolicited messages transported by electronic
        mail.
      annotation: Does the organization utilize anti-phishing and spam protection
        technologies to detect and take action on unsolicited messages transported
        by electronic mail?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-08.1
      name: Central Management
      description: Mechanisms exist to centrally-manage anti-phishing and spam protection
        technologies.
      annotation: Does the organization centrally-manage anti-phishing and spam protection
        technologies?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-08.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-08.2
      name: Automatic Spam and Phishing Protection Updates
      description: Mechanisms exist to automatically update anti-phishing and spam
        protection technologies when new releases are available in accordance with
        configuration and change management practices.
      annotation: Does the organization automatically update anti-phishing and spam
        protection technologies when new releases are available in accordance with
        configuration and change management practices?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-09
      name: Trusted Path
      description: Mechanisms exist to establish a trusted communications path between
        the user and the security functions of the operating system.
      annotation: Does the organization establish a trusted communications path between
        the user and the security functions of the operating system?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-10
      name: Mobile Code
      description: Mechanisms exist to address mobile code / operating system-independent
        applications.
      annotation: Does the organization address mobile code / operating system-independent
        applications?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-11
      name: Thin Nodes
      description: Mechanisms exist to configure thin nodes to have minimal functionality
        and information storage.
      annotation: Does the organization configure thin nodes to have minimal functionality
        and information storage?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-12
      name: Port & Input / Output (I/O) Device Access
      description: Mechanisms exist to physically disable or remove unnecessary connection
        ports or input/output devices from sensitive systems.
      annotation: Does the organization physically disable or remove unnecessary connection
        ports or input/output devices from sensitive systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-13
      name: Sensor Capability
      description: "Mechanisms exist to configure embedded sensors on systems to:\
        \ \n(1) Prohibit the remote activation of sensing capabilities; and\n(2) Provide\
        \ an explicit indication of sensor use to users."
      annotation: "Does the organization configure embedded sensors on systems to:\
        \ \n (1) Prohibit the remote activation of sensing capabilities; and\n (2)\
        \ Provide an explicit indication of sensor use to users?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-13.1
      name: Authorized Use
      description: Mechanisms exist to utilize organization-defined measures so that
        data or information collected by sensors is only used for authorized purposes.
      annotation: Does the organization utilize organization-defined measures so that
        data or information collected by sensors is only used for authorized purposes?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-13.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-13.2
      name: Notice of Collection
      description: Mechanisms exist to notify individuals that Personal Data (PD)
        is collected by sensors.
      annotation: Does the organization notify individuals that Personal Data (PD)
        is collected by sensors?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-13.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-13.3
      name: Collection Minimization
      description: Mechanisms exist to utilize sensors that are configured to minimize
        the collection of information about individuals.
      annotation: Does the organization utilize sensors that are configured to minimize
        the collection of information about individuals?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-13.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-13.4
      name: Sensor Delivery Verification
      description: Mechanisms exist to verify embedded technology sensors are configured
        so that data collected by the sensor(s) is only reported to authorized individuals
        or roles.
      annotation: Does the organization verify embedded technology sensors are configured
        so that data collected by the sensor(s) is only reported to authorized individuals
        or roles?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14
      name: Collaborative Computing Devices
      description: "Mechanisms exist to unplug or prohibit the remote activation of\
        \ collaborative computing devices with the following exceptions: \n(1) Networked\
        \ whiteboards; \n(2) Video teleconference cameras; and \n(3) Teleconference\
        \ microphones."
      annotation: "Does the organization unplug or prohibit the remote activation\
        \ of collaborative computing devices with the following exceptions: \n (1)\
        \ Networked whiteboards; \n (2) Video teleconference cameras; and \n (3) Teleconference\
        \ microphones?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14.1
      name: Disabling / Removal In Secure Work Areas
      description: Mechanisms exist to disable or remove collaborative computing devices
        from critical information systems and secure work areas.
      annotation: Does the organization disable or remove collaborative computing
        devices from critical information systems and secure work areas?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14.2
      name: Explicitly Indicate Current Participants
      description: Automated mechanisms exist to provide an explicit indication of
        current participants in online meetings and teleconferences.
      annotation: Does the organization use automated mechanisms to provide an explicit
        indication of current participants in online meetings and teleconferences?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14.3
      name: Participant Identity Verification
      description: Mechanisms exist to verify individual identities to ensure that
        access to virtual meetings is limited to appropriate individuals.
      annotation: Does the organization verify individual identities to ensure that
        access to virtual meetings is limited to appropriate individuals?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14.4
      name: Participant Connection Management
      description: Mechanisms exist to ensure the meeting host can positively control
        an individual's participation in virtual meetings.
      annotation: Does the organization ensure the meeting host can positively control
        an individual's participation in virtual meetings?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14.5
      name: Malicious Link & File Protections
      description: Automated mechanisms exist to detect malicious links and/or files
        in communications and prevent users from accessing those malicious links and/or
        files.
      annotation: Does the organization use automated mechanisms to detect malicious
        links and/or files in communications and prevent users from accessing those
        malicious links and/or files?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-14.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-14.6
      name: Explicit Indication Of Use
      description: Mechanisms exist to configure collaborative computing devices to
        provide physically-present individuals with an explicit indication of use.
      annotation: Does the organization configure collaborative computing devices
        to provide physically-present individuals with an explicit indication of use?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-15
      name: Hypervisor Access
      description: Mechanisms exist to restrict access to hypervisor management functions
        or administrative consoles for systems hosting virtualized systems.
      annotation: Does the organization restrict access to hypervisor management functions
        or administrative consoles for systems hosting virtualized systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-16
      name: Restrict Access To Security Functions
      description: Mechanisms exist to ensure security functions are restricted to
        authorized individuals and enforce least privilege control requirements for
        necessary job functions.
      annotation: Does the organization ensure security functions are restricted to
        authorized individuals and enforce least privilege control requirements for
        necessary job functions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:end-16.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:end
      ref_id: END-16.1
      name: Host-Based Security Function Isolation
      description: Mechanisms exist to implement underlying software separation mechanisms
        to facilitate security function isolation.
      annotation: Does the organization implement underlying software separation mechanisms
        to facilitate security function isolation?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      assessable: false
      depth: 1
      ref_id: HRS
      name: Human Resources Security
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-01
      name: Human Resources Security Management
      description: Mechanisms exist to facilitate the implementation of personnel
        security controls.
      annotation: Does the organization facilitate the implementation of personnel
        security controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-01.1
      name: Onboarding, Transferring & Offboarding Personnel
      description: "Mechanisms exist to proactively govern the following personnel\
        \ management actions:\n(1) Onboarding new personnel (e.g., new hires);\n(2)\
        \ Transferring personnel into new roles within the organization; and \n(3)\
        \ Offboarding personnel (e.g., termination of employment)."
      annotation: "Does the organization proactively govern the following personnel\
        \ management actions:\n(1) Onboarding new personnel (e.g., new hires);\n(2)\
        \ Transferring personnel into new roles within the organization; and \n(3)\
        \ Offboarding personnel (e.g., termination of employment)?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-02
      name: Position Categorization
      description: Mechanisms exist to manage personnel security risk by assigning
        a risk designation to all positions and establishing screening criteria for
        individuals filling those positions.
      annotation: Does the organization manage personnel security risk by assigning
        a risk designation to all positions and establishing screening criteria for
        individuals filling those positions?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-02.1
      name: Users With Elevated Privileges
      description: Mechanisms exist to ensure that every user accessing a system that
        processes, stores, or transmits sensitive information is cleared and regularly
        trained to handle the information in question.
      annotation: Does the organization ensure that every user accessing a system
        that processes, stores, or transmits sensitive information is cleared and
        regularly trained to handle the information in question?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-02.2
      name: Probationary Periods
      description: Mechanisms exist to identify newly onboarded personnel for enhanced
        monitoring during their probationary period.
      annotation: Does the organization identify newly onboarded personnel for enhanced
        monitoring during their probationary period?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-03
      name: Defined Roles & Responsibilities
      description: Mechanisms exist to define cybersecurity roles & responsibilities
        for all personnel.
      annotation: Does the organization define cybersecurity roles & responsibilities
        for all personnel?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-03.1
      name: User Awareness
      description: Mechanisms exist to communicate with users about their roles and
        responsibilities to maintain a safe and secure working environment.
      annotation: Does the organization communicate with users about their roles and
        responsibilities to maintain a safe and secure working environment?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-03.2
      name: Competency Requirements for Security-Related Positions
      description: Mechanisms exist to ensure that all security-related positions
        are staffed by qualified individuals who have the necessary skill set.
      annotation: Does the organization ensure that all security-related positions
        are staffed by qualified individuals who have the necessary skill set?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-04
      name: Personnel Screening
      description: Mechanisms exist to manage personnel security risk by screening
        individuals prior to authorizing access.
      annotation: Does the organization manage personnel security risk by screening
        individuals prior to authorizing access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-04.1
      name: Roles With Special Protection Measures
      description: Mechanisms exist to ensure that individuals accessing a system
        that stores, transmits or processes information requiring special protection
        satisfy organization-defined personnel screening criteria.
      annotation: Does the organization ensure that individuals accessing a system
        that stores, transmits or processes information requiring special protection
        satisfy organization-defined personnel screening criteria?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-04.2
      name: Formal Indoctrination
      description: Mechanisms exist to formally educate authorized users on proper
        data handling practices for all the relevant types of data to which they have
        access.
      annotation: Does the organization formally educate authorized users on proper
        data handling practices for all the relevant types of data to which they have
        access?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-04.3
      name: Citizenship Requirements
      description: Mechanisms exist to verify that individuals accessing a system
        processing, storing, or transmitting sensitive information meet applicable
        statutory, regulatory and/or contractual requirements for citizenship.
      annotation: Does the organization verify that individuals accessing a system
        processing, storing, or transmitting sensitive information meet applicable
        statutory, regulatory and/or contractual requirements for citizenship?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-04.4
      name: Citizenship Identification
      description: Mechanisms exist to identify foreign nationals, including by their
        specific citizenship.
      annotation: Does the organization identify foreign nationals, including by their
        specific citizenship?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05
      name: Terms of Employment
      description: Mechanisms exist to require all employees and contractors to apply
        cybersecurity & data privacy principles in their daily work.
      annotation: Does the organization require all employees and contractors to apply
        cybersecurity & data privacy principles in their daily work?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.1
      name: Rules of Behavior
      description: Mechanisms exist to define acceptable and unacceptable rules of
        behavior for the use of technologies, including consequences for unacceptable
        behavior.
      annotation: Does the organization define acceptable and unacceptable rules of
        behavior for the use of technologies, including consequences for unacceptable
        behavior?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.2
      name: Social Media & Social Networking Restrictions
      description: Mechanisms exist to define rules of behavior that contain explicit
        restrictions on the use of social media and networking sites, posting information
        on commercial websites and sharing account information.
      annotation: Does the organization define rules of behavior that contain explicit
        restrictions on the use of social media and networking sites, posting information
        on commercial websites and sharing account information?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.3
      name: Technology Use Restrictions
      description: Mechanisms exist to establish usage restrictions and implementation
        guidance for organizational technologies based on the potential to cause damage
        to systems, if used maliciously.
      annotation: Does the organization establish usage restrictions and implementation
        guidance for communications technologies based on the potential to cause damage
        to systems, if used maliciously?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.4
      name: Use of Critical Technologies
      description: Mechanisms exist to govern usage policies for critical technologies.
      annotation: Does the organization govern usage policies for critical technologies?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.5
      name: Use of Mobile Devices
      description: Mechanisms exist to manage business risks associated with permitting
        mobile device access to organizational resources.
      annotation: Does the organization manage business risks associated with permitting
        mobile device access to organizational resources?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.6
      name: Security-Minded Dress Code
      description: Mechanisms exist to prohibit the use of oversized clothing (e.g.,
        baggy pants, oversized hooded sweatshirts, etc.) to prevent the unauthorized
        exfiltration of data and technology assets.
      annotation: Does the organization prohibit the use of oversized clothing (e.g.,
        baggy pants, oversized hooded sweatshirts, etc.) to prevent the unauthorized
        exfiltration of data and technology assets?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-05.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-05.7
      name: Policy Familiarization & Acknowledgement
      description: Mechanisms exist to ensure personnel receive recurring familiarization
        with the organization's cybersecurity & data privacy policies and provide
        acknowledgement.
      annotation: Does the organization ensure personnel receive recurring familiarization
        with its cybersecurity & data privacy policies and provide acknowledgement?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-06
      name: Access Agreements
      description: Mechanisms exist to require internal and third-party users to sign
        appropriate access agreements prior to being granted access.
      annotation: Does the organization require internal and third-party users to
        sign appropriate access agreements prior to being granted access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-06.1
      name: Confidentiality Agreements
      description: Mechanisms exist to require Non-Disclosure Agreements (NDAs) or
        similar confidentiality agreements that reflect the needs to protect data
        and operational details, or both employees and third-parties.
      annotation: Does the organization require Non-Disclosure Agreements (NDAs) or
        similar confidentiality agreements that reflect the needs to protect data
        and operational details, or both employees and third-parties?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-06.2
      name: Post-Employment Requirements Awareness
      description: Mechanisms exist to notify individuals of their applicable, legally-binding
        post-employment requirements for the protection of sensitive/regulated data.
      annotation: Does the organization notify individuals of their applicable, legally-binding
        post-employment requirements for the protection of sensitive/regulated data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-07
      name: Personnel Sanctions
      description: Mechanisms exist to sanction personnel failing to comply with established
        security policies, standards and procedures.
      annotation: Does the organization sanction personnel failing to comply with
        established security policies, standards and procedures?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-07.1
      name: Workplace Investigations
      description: Mechanisms exist to conduct employee misconduct investigations
        when there is reasonable assurance that a policy has been violated.
      annotation: Does the organization conduct employee misconduct investigations
        when there is reasonable assurance that a policy has been violated?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-07.2
      name: Updating Disciplinary Processes
      description: 'Mechanisms exist to periodically review and, where appropriate,
        update disciplinary practices due to:

        (1) Legal changes;

        (2) Significant changes to operations; and

        (3) Applicable threats and risks.'
      annotation: 'Does the organization periodically review and, where appropriate,
        update disciplinary practices due to:

        (1) Legal changes;

        (2) Significant changes to operations; and

        (3) Applicable threats and risks?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-08
      name: Personnel Transfer
      description: Mechanisms exist to adjust logical and physical access authorizations
        to systems and facilities upon personnel reassignment or transfer, in a timely
        manner.
      annotation: Does the organization adjust logical and physical access authorizations
        to systems and facilities upon personnel reassignment or transfer, in a timely
        manner?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-09
      name: Personnel Termination
      description: Mechanisms exist to govern the termination of individual employment.
      annotation: Does the organization govern the termination of individual employment?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-09.1
      name: Asset Collection
      description: Mechanisms exist to retrieve organization-owned assets upon termination
        of an individual's employment.
      annotation: Does the organization retrieve organization-owned assets upon termination
        of an individual's employment?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-09.2
      name: High-Risk Terminations
      description: "Mechanisms exist to expedite the process of removing \"high risk\"\
        \ individual\u2019s access to systems and applications upon termination, as\
        \ determined by management."
      annotation: "Does the organization expedite the process of removing \"high risk\"\
        \ individual\u2019s access to systems and applications upon termination, as\
        \ determined by management?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-09.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-09.3
      name: Post-Employment Requirements Notification
      description: Mechanisms exist to govern former employee behavior by formally
        notifying terminated individuals of their applicable, legally binding post-employment
        requirements for the protection of sensitive/regulated data.
      annotation: Does the organization govern former employee behavior by formally
        notifying terminated individuals of their applicable, legally binding post-employment
        requirements for the protection of sensitive/regulated data?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-09.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-09.4
      name: Automated Employment Status Notifications
      description: Automated mechanisms exist to notify Identity and Access Management
        (IAM) personnel or roles upon termination of an individual employment or contract.
      annotation: Does the organization use automated mechanisms to notify Identity
        and Access Management (IAM) personnel or roles upon termination of an individual
        employment or contract?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-10
      name: Third-Party Personnel Security
      description: Mechanisms exist to govern third-party personnel by reviewing and
        monitoring third-party cybersecurity & data privacy roles and responsibilities.
      annotation: Does the organization govern third-party personnel by reviewing
        and monitoring third-party cybersecurity & data privacy roles and responsibilities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-11
      name: Separation of Duties (SoD)
      description: Mechanisms exist to implement and maintain Separation of Duties
        (SoD) to prevent potential inappropriate activity without collusion.
      annotation: Does the organization implement and maintain Separation of Duties
        (SoD) to prevent potential inappropriate activity without collusion?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-12
      name: Incompatible Roles
      description: Mechanisms exist to avoid incompatible development-specific roles
        through limiting and reviewing developer privileges to change hardware, software
        and firmware components within a production/operational environment.
      annotation: Does the organization avoid incompatible development-specific roles
        through limiting and reviewing developer privileges to change hardware, software
        and firmware components within a production/operational environment?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-12.1
      name: Two-Person Rule
      description: Mechanisms exist to enforce a two-person rule for implementing
        changes to sensitive systems.
      annotation: Does the organization enforce a two-person rule for implementing
        changes to sensitive systems?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-13
      name: Identify Critical Skills & Gaps
      description: Mechanisms exist to evaluate the critical cybersecurity & data
        privacy skills needed to support the organization's mission and identify gaps
        that exist.
      annotation: Does the organization evaluate the critical cybersecurity & data
        privacy skills needed to support its mission and identify gaps that exist?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-13.1
      name: Remediate Identified Skills Deficiencies
      description: Mechanisms exist to remediate critical skills deficiencies necessary
        to support the organization's mission and business functions.
      annotation: Does the organization remediate critical skills deficiencies necessary
        to support its mission and business functions?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-13.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-13.2
      name: Identify Vital Cybersecurity & Data Privacy Staff
      description: Mechanisms exist to identify vital cybersecurity & data privacy
        staff.
      annotation: Does the organization identify vital cybersecurity & data privacy
        staff?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-13.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-13.3
      name: Establish Redundancy for Vital Cybersecurity & Data Privacy Staff
      description: Mechanisms exist to establish redundancy for vital cybersecurity
        & data privacy staff.
      annotation: Does the organization establish redundancy for vital cybersecurity
        & data privacy staff?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-13.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-13.4
      name: Perform Succession Planning
      description: Mechanisms exist to perform succession planning for vital cybersecurity
        & data privacy roles.
      annotation: Does the organization perform succession planning for vital cybersecurity
        & data privacy roles?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-14
      name: Identifying Authorized Work Locations
      description: 'Mechanisms exist to identify and document authorized working locations,
        including:

        (1) Designated on-premises, organization-controlled work locations; and

        (2) Other off-premises locations not under organization-control (e.g., work
        from home).'
      annotation: 'Does the organization identity and document authorized working
        locations, including:

        (1) Designated on-premises, organization-controlled work locations; and

        (2) Other off-premises locations not under organization-control (e.g., work
        from home)?'
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-14.1
      name: Communicating Authorized Work Locations
      description: Mechanisms exist to communicate authorized work locations to organizational
        personnel.
      annotation: Does the organization communicate authorized work locations to organizational
        personnel?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:hrs
      ref_id: HRS-15
      name: Reporting Suspicious Activities
      description: Mechanisms exist to enable personnel to report suspicious activities
        and/or behavior without fear of reprisal or other negative consequences (e.g.,
        whistleblower protections).
      annotation: Does the organization enable personnel to report suspicious activities
        and/or behavior without fear of reprisal or other negative consequences (e.g.,
        whistleblower protections)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      assessable: false
      depth: 1
      ref_id: IAC
      name: Identification & Authentication
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-01
      name: Identity & Access Management (IAM)
      description: Mechanisms exist to facilitate the implementation of identification
        and access management controls.
      annotation: Does the organization facilitate the implementation of identification
        and access management controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-01.1
      name: Retain Access Records
      description: Mechanisms exist to retain a record of personnel accountability
        to ensure there is a record of all access granted to an individual (system
        and application-wise), who provided the authorization, when the authorization
        was granted and when the access was last reviewed.
      annotation: Does the organization retain a record of personnel accountability
        to ensure there is a record of all access granted to an individual (system
        and application-wise), who provided the authorization, when the authorization
        was granted and when the access was last reviewed?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-01.2
      name: Authenticate, Authorize and Audit (AAA)
      description: Mechanisms exist to strictly govern the use of Authenticate, Authorize
        and Audit (AAA) solutions, both on-premises and those hosted by an External
        Service Provider (ESP).
      annotation: Does the organization strictly govern the use of Authenticate, Authorize
        and Audit (AAA) solutions, both on-premises and those hosted by an External
        Service Provider (ESP)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-01.3
      name: User & Service Account Inventories
      description: Mechanisms exist to maintain a current list of authorized users
        and service accounts.
      annotation: Does the organization maintain a current list of authorized users
        and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-02
      name: Identification & Authentication for Organizational Users
      description: Mechanisms exist to uniquely identify and centrally Authenticate,
        Authorize and Audit (AAA) organizational users and processes acting on behalf
        of organizational users.
      annotation: Does the organization uniquely identify and centrally Authenticate,
        Authorize and Audit (AAA) organizational users and processes acting on behalf
        of organizational users?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-02.1
      name: Group Authentication
      description: Mechanisms exist to require individuals to be authenticated with
        an individual authenticator when a group authenticator is utilized.
      annotation: Does the organization require individuals to be authenticated with
        an individual authenticator when a group authenticator is utilized?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-02.2
      name: Replay-Resistant Authentication
      description: Automated mechanisms exist to employ replay-resistant authentication.
      annotation: Does the organization use automated mechanisms to employ replay-resistant
        authentication?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-02.3
      name: Acceptance of PIV Credentials
      description: Mechanisms exist to accept and electronically verify organizational
        Personal Identity Verification (PIV) credentials.
      annotation: Does the organization accept and electronically verify organizational
        Personal Identity Verification (PIV) credentials?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-02.4
      name: Out-of-Band Authentication (OOBA)
      description: Mechanisms exist to implement Out-of-Band Authentication (OOBA)
        under specific conditions.
      annotation: Does the organization implement Out-of-Band Authentication (OOBA)
        under specific conditions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-03
      name: Identification & Authentication for Non-Organizational Users
      description: Mechanisms exist to uniquely identify and centrally Authenticate,
        Authorize and Audit (AAA) third-party users and processes that provide services
        to the organization.
      annotation: Does the organization uniquely identify and centrally Authenticate,
        Authorize and Audit (AAA) third-party users and processes that provide services
        to the organization?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-03.1
      name: Acceptance of PIV Credentials from Other Organizations
      description: Mechanisms exist to accept and electronically verify Personal Identity
        Verification (PIV) credentials from third-parties.
      annotation: Does the organization accept and electronically verify Personal
        Identity Verification (PIV) credentials from third-parties?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-03.2
      name: Acceptance of Third-Party Credentials
      description: Automated mechanisms exist to accept Federal Identity, Credential
        and Access Management (FICAM)-approved third-party credentials.
      annotation: Does the organization use automated mechanisms to accept Federal
        Identity, Credential and Access Management (FICAM)-approved third-party credentials?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-03.3
      name: Use of FICAM-Issued Profiles
      description: Mechanisms exist to conform systems to Federal Identity, Credential
        and Access Management (FICAM)-issued profiles.
      annotation: Does the organization conform systems to Federal Identity, Credential
        and Access Management (FICAM)-issued profiles?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-03.4
      name: Disassociability
      description: Mechanisms exist to disassociate user attributes or credential
        assertion relationships among individuals, credential service providers and
        relying parties.
      annotation: Does the organization disassociate user attributes or credential
        assertion relationships among individuals, credential service providers and
        relying parties?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-03.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-03.5
      name: Acceptance of External Authenticators
      description: Mechanisms exist to restrict the use of external authenticators
        to those that are National Institute of Standards and Technology (NIST)-compliant
        and maintain a list of accepted external authenticators.
      annotation: Does the organization restrict the use of external authenticators
        to those that are National Institute of Standards and Technology (NIST)-compliant
        and maintain a list of accepted external authenticators?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-04
      name: Identification & Authentication for Devices
      description: Mechanisms exist to uniquely identify and centrally Authenticate,
        Authorize and Audit (AAA) devices before establishing a connection using bidirectional
        authentication that is cryptographically- based and replay resistant.
      annotation: Does the organization uniquely identify and centrally Authenticate,
        Authorize and Audit (AAA) devices before establishing a connection using bidirectional
        authentication that is cryptographically- based and replay resistant?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-04.1
      name: Device Attestation
      description: Mechanisms exist to ensure device identification and authentication
        is accurate by centrally-managing the joining of systems to the domain as
        part of the initial asset configuration management process.
      annotation: Does the organization ensure device identification and authentication
        is accurate by centrally-managing the joining of systems to the domain as
        part of the initial asset configuration management process?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-04.2
      name: Device Authorization Enforcement
      description: Mechanisms exist to enforce cryptographic communications keys to
        prevent one key from being used to access multiple devices.
      annotation: Does the organization enforce cryptographic communications keys
        to prevent one key from being used to access multiple devices?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-05
      name: Identification & Authentication for Third Party Systems & Services
      description: Mechanisms exist to identify and authenticate third-party systems
        and services.
      annotation: Does the organization identify and authenticate third-party systems
        and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-05.1
      name: Sharing Identification & Authentication Information
      description: Mechanisms exist to ensure external service providers provide current
        and accurate information for any third-party user with access to the organization's
        data or assets.
      annotation: Does the organization ensure external service providers provide
        current and accurate information for any third-party user with access to its
        data or assets?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-05.2
      name: Privileged Access by Non-Organizational Users
      description: Mechanisms exist to prohibit privileged access by non-organizational
        users.
      annotation: Does the organization prohibit privileged access by non-organizational
        users?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-06
      name: Multi-Factor Authentication (MFA)
      description: "Automated mechanisms exist to enforce Multi-Factor Authentication\
        \ (MFA) for:\n(1) Remote network access; \n(2) Third-party systems, applications\
        \ and/or services; and/ or\n(3) Non-console access to critical systems or\
        \ systems that store, transmit and/or process sensitive/regulated data."
      annotation: "Does the organization use automated mechanisms to enforce Multi-Factor\
        \ Authentication (MFA) for:\n (1) Remote network access; \n (2) Third-party\
        \ systems, applications and/or services; and/ or\n (3) Non-console access\
        \ to critical systems or systems that store, transmit and/or process sensitive/regulated\
        \ data?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-06.1
      name: Network Access to Privileged Accounts
      description: Mechanisms exist to utilize Multi-Factor Authentication (MFA) to
        authenticate network access for privileged accounts.
      annotation: Does the organization utilize Multi-Factor Authentication (MFA)
        to authenticate network access for privileged accounts?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-06.2
      name: Network Access to Non-Privileged Accounts
      description: Mechanisms exist to utilize Multi-Factor Authentication (MFA) to
        authenticate network access for non-privileged accounts.
      annotation: Does the organization utilize Multi-Factor Authentication (MFA)
        to authenticate network access for non-privileged accounts?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-06.3
      name: Local Access to Privileged Accounts
      description: Mechanisms exist to utilize Multi-Factor Authentication (MFA) to
        authenticate local access for privileged accounts.
      annotation: Does the organization utilize Multi-Factor Authentication (MFA)
        to authenticate local access for privileged accounts?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-06.4
      name: Out-of-Band Multi-Factor Authentication
      description: Mechanisms exist to implement Multi-Factor Authentication (MFA)
        for access to privileged and non-privileged accounts such that one of the
        factors is independently provided by a device separate from the system being
        accessed.
      annotation: Does the organization implements Multi-Factor Authentication (MFA)
        for access to privileged and non-privileged accounts such that one of the
        factors is securely provided by a device separate from the system gaining
        access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-07
      name: User Provisioning & De-Provisioning
      description: Mechanisms exist to utilize a formal user registration and de-registration
        process that governs the assignment of access rights.
      annotation: Does the organization utilize a formal user registration and de-registration
        process that governs the assignment of access rights?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-07.1
      name: Change of Roles & Duties
      description: Mechanisms exist to revoke user access rights following changes
        in personnel roles and duties, if no longer necessary or permitted.
      annotation: Does the organization revoke user access rights following changes
        in personnel roles and duties, if no longer necessary or permitted?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-07.2
      name: Termination of Employment
      description: Mechanisms exist to revoke user access rights in a timely manner,
        upon termination of employment or contract.
      annotation: Does the organization revoke user access rights in a timely manner,
        upon termination of employment or contract?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-08
      name: Role-Based Access Control (RBAC)
      description: Mechanisms exist to enforce a Role-Based Access Control (RBAC)
        policy over users and resources that applies need-to-know and fine-grained
        access control for sensitive/regulated data access.
      annotation: Does the organization enforce a Role-Based Access Control (RBAC)
        policy over users and resources that applies need-to-know and fine-grained
        access control for sensitive/regulated data access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09
      name: Identifier Management (User Names)
      description: Mechanisms exist to govern naming standards for usernames and systems.
      annotation: Does the organization govern naming standards for usernames and
        systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09.1
      name: User Identity (ID) Management
      description: Mechanisms exist to ensure proper user identification management
        for non-consumer users and administrators.
      annotation: Does the organization ensure proper user identification management
        for non-consumer users and administrators?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09.2
      name: Identity User Status
      description: Mechanisms exist to identify contractors and other third-party
        users through unique username characteristics.
      annotation: Does the organization identify contractors and other third-party
        users through unique username characteristics?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09.3
      name: Dynamic Management
      description: Mechanisms exist to dynamically manage usernames and system identifiers.
      annotation: Does the organization dynamically manage usernames and system identifiers?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09.4
      name: Cross-Organization Management
      description: Mechanisms exist to coordinate username identifiers with external
        organizations for cross-organization management of identifiers.
      annotation: Does the organization coordinate username identifiers with external
        organizations for cross-organization management of identifiers?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09.5
      name: Privileged Account Identifiers
      description: Mechanisms exist to uniquely manage privileged accounts to identify
        the account as a privileged user or service.
      annotation: Does the organization uniquely manage privileged accounts to identify
        the account as a privileged user or service?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-09.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-09.6
      name: Pairwise Pseudonymous Identifiers (PPID)
      description: Mechanisms exist to generate pairwise pseudonymous identifiers
        with no identifying information about a data subject to discourage activity
        tracking and profiling of the data subject.
      annotation: Does the organization generate pairwise pseudonymous identifiers
        with no identifying information about a data subject to discourage activity
        tracking and profiling of the data subject?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10
      name: Authenticator Management
      description: 'Mechanisms exist to:

        (1) Securely manage authenticators for users and devices; and

        (2) Ensure the strength of authentication is appropriate to the classification
        of the data being accessed.'
      annotation: 'Does the organization:

        (1) Securely manage authenticators for users and devices; and

        (2) Ensure the strength of authentication is appropriate to the classification
        of the data being accessed?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.1
      name: Password-Based Authentication
      description: Mechanisms exist to enforce complexity, length and lifespan considerations
        to ensure strong criteria for password-based authentication.
      annotation: Does the organization enforce complexity, length and lifespan considerations
        to ensure strong criteria for password-based authentication?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.2
      name: PKI-Based Authentication
      description: Automated mechanisms exist to validate certificates by constructing
        and verifying a certification path to an accepted trust anchor including checking
        certificate status information for PKI-based authentication.
      annotation: Does the organization use automated mechanisms to validate certificates
        by constructing and verifying a certification path to an accepted trust anchor
        including checking certificate status information for PKI-based authentication?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.3
      name: In-Person or Trusted Third-Party Registration
      description: Mechanisms exist to conduct in-person or trusted third-party identify
        verification before user accounts for third-parties are created.
      annotation: Does the organization conduct in-person or trusted third-party identify
        verification before user accounts for third-parties are created?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.4
      name: Automated Support For Password Strength
      description: Automated mechanisms exist to determine if password authenticators
        are sufficiently strong enough to satisfy organization-defined password length
        and complexity requirements.
      annotation: Does the organization use automated mechanisms to determine if password
        authenticators are sufficiently strong enough to satisfy organization-defined
        password length and complexity requirements?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.5
      name: Protection of Authenticators
      description: Mechanisms exist to protect authenticators commensurate with the
        sensitivity of the information to which use of the authenticator permits access.
      annotation: Does the organization protect authenticators commensurate with the
        sensitivity of the information to which use of the authenticator permits access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.6
      name: No Embedded Unencrypted Static Authenticators
      description: Mechanisms exist to ensure that unencrypted, static authenticators
        are not embedded in applications, scripts or stored on function keys.
      annotation: Does the organization ensure that unencrypted, static authenticators
        are not embedded in applications, scripts or stored on function keys?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.7
      name: Hardware Token-Based Authentication
      description: Automated mechanisms exist to ensure organization-defined token
        quality requirements are satisfied for hardware token-based authentication.
      annotation: Does the organization use automated mechanisms to ensure organization-defined
        token quality requirements are satisfied for hardware token-based authentication?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.8
      name: Default Authenticators
      description: Mechanisms exist to ensure default authenticators are changed as
        part of account creation or system installation.
      annotation: Does the organization ensure default authenticators are changed
        as part of account creation or system installation?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.9
      name: Multiple Information System Accounts
      description: Mechanisms exist to implement security safeguards to manage the
        risk of compromise due to individuals having accounts on multiple information
        systems.
      annotation: Does the organization implement security safeguards to manage the
        risk of compromise due to individuals having accounts on multiple information
        systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.10
      name: Expiration of Cached Authenticators
      description: Automated mechanisms exist to prohibit the use of cached authenticators
        after organization-defined time period.
      annotation: Does the organization use automated mechanisms to prohibit the use
        of cached authenticators after organization-defined time period?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.11
      name: Password Managers
      description: Mechanisms exist to protect and store passwords via a password
        manager tool.
      annotation: Does the organization protect and store passwords via a password
        manager tool?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.12
      name: Biometric Authentication
      description: Mechanisms exist to ensure biometric-based authentication satisfies
        organization-defined biometric quality requirements for false positives and
        false negatives.
      annotation: Does the organization ensure biometric-based authentication satisfies
        organization-defined biometric quality requirements for false positives and
        false negatives?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-10.13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-10.13
      name: Events Requiring Authenticator Change
      description: 'Mechanisms exist to change authentication credentials:

        (1) At predefined intervals; and/or

        (2) Upon suspicion of credential compromise.'
      annotation: 'Does the organization change authentication credentials:

        (1) At predefined intervals; and/or

        (2) Upon suspicion of credential compromise?'
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-11
      name: Authenticator Feedback
      description: Mechanisms exist to obscure the feedback of authentication information
        during the authentication process to protect the information from possible
        exploitation/use by unauthorized individuals.
      annotation: Does the organization obscure the feedback of authentication information
        during the authentication process to protect the information from possible
        exploitation/use by unauthorized individuals?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-12
      name: Cryptographic Module Authentication
      description: Mechanisms exist to ensure cryptographic modules adhere to applicable
        statutory, regulatory and contractual requirements for security strength.
      annotation: Does the organization ensure cryptographic modules adhere to applicable
        statutory, regulatory and contractual requirements for security strength?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-12.1
      name: Hardware Security Modules (HSM)
      description: Automated mechanisms exist to utilize Hardware Security Modules
        (HSM) to protect authenticators on which the component relies.
      annotation: Does the organization use automated mechanisms to utilize Hardware
        Security Modules (HSM) to protect authenticators on which the component relies?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-13
      name: Adaptive Identification & Authentication
      description: Mechanisms exist to allow individuals to utilize alternative methods
        of authentication under specific circumstances or situations.
      annotation: Does the organization allow individuals to utilize alternative methods
        of authentication under specific circumstances or situations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-13.1
      name: Single Sign-On (SSO) Transparent Authentication
      description: Mechanisms exist to provide a transparent authentication (e.g.,
        Single Sign-On (SSO)) capability to the organization's systems and services.
      annotation: Does the organization provide a Single Sign-On (SSO) capability
        to its systems and services?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-13.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-13.2
      name: Federated Credential Management
      description: Mechanisms exist to federate credentials to allow cross-organization
        authentication of individuals and devices.
      annotation: Does the organization federate credentials to allow cross-organization
        authentication of individuals and devices?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-13.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-13.3
      name: Continuous Authentication
      description: Automated mechanisms exist to enable continuous re-authentication
        through the lifecycle of entity interactions.
      annotation: Does the organization use automated mechanisms to enable continuous
        re-authentication through the lifecycle of entity interactions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-14
      name: Re-Authentication
      description: Mechanisms exist to force users and devices to re-authenticate
        according to organization-defined circumstances that necessitate re-authentication.
      annotation: Does the organization force users and devices to re-authenticate
        according to organization-defined circumstances that necessitate re-authentication?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15
      name: Account Management
      description: Mechanisms exist to proactively govern account management of individual,
        group, system, service, application, guest and temporary accounts.
      annotation: Does the organization proactively govern account management of individual,
        group, system, service, application, guest and temporary accounts?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.1
      name: Automated System Account Management (Directory Services)
      description: Automated mechanisms exist to support the management of system
        accounts (e.g., directory services).
      annotation: Does the organization use automated mechanisms to support the management
        of system accounts?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.2
      name: Removal of Temporary / Emergency Accounts
      description: Automated mechanisms exist to disable or remove temporary and emergency
        accounts after an organization-defined time period for each type of account.
      annotation: Does the organization use automated mechanisms to disable or remove
        temporary and emergency accounts after an organization-defined time period
        for each type of account?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.3
      name: Disable Inactive Accounts
      description: Automated mechanisms exist to disable inactive accounts after an
        organization-defined time period.
      annotation: Does the organization use automated mechanisms to disable inactive
        accounts after an organization-defined time period?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.4
      name: Automated Audit Actions
      description: Automated mechanisms exist to audit account creation, modification,
        enabling, disabling and removal actions and notify organization-defined personnel
        or roles.
      annotation: Does the organization use automated mechanisms to audit account
        creation, modification, enabling, disabling and removal actions and notify
        organization-defined personnel or roles?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.5
      name: Restrictions on Shared Groups / Accounts
      description: Mechanisms exist to authorize the use of shared/group accounts
        only under certain organization-defined conditions.
      annotation: Does the organization authorize the use of shared/group accounts
        only under certain organization-defined conditions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.6
      name: Account Disabling for High Risk Individuals
      description: Mechanisms exist to disable accounts immediately upon notification
        for users posing a significant risk to the organization.
      annotation: Does the organization disable accounts immediately upon notification
        for users posing a significant risk to the organization?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.7
      name: System Account Reviews
      description: Mechanisms exist to review all system accounts and disable any
        account that cannot be associated with a business process and owner.
      annotation: Does the organization review all system accounts and disables any
        account that cannot be associated with a business process and owner?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.8
      name: Usage Conditions
      description: Automated mechanisms exist to enforce usage conditions for users
        and/or roles.
      annotation: Does the organization use automated mechanisms to enforce usage
        conditions for users and/or roles?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-15.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-15.9
      name: Emergency Accounts
      description: Mechanisms exist to establish and control "emergency access only"
        accounts.
      annotation: Does the organization establish and control "emergency access only"
        accounts?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-16
      name: Privileged Account Management (PAM)
      description: Mechanisms exist to restrict and control privileged access rights
        for users and services.
      annotation: Does the organization restrict and control privileged access rights
        for users and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-16.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-16.1
      name: Privileged Account Inventories
      description: Mechanisms exist to inventory all privileged accounts and validate
        that each person with elevated privileges is authorized by the appropriate
        level of organizational management.
      annotation: Does the organization inventory all privileged accounts and validate
        that each person with elevated privileges is authorized by the appropriate
        level of organizational management?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-16.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-16.2
      name: Privileged Account Separation
      description: Mechanisms exist to separate privileged accounts between infrastructure
        environments to reduce the risk of a compromise in one infrastructure environment
        from laterally affecting other infrastructure environments.
      annotation: Does the organization separate privileged accounts between infrastructure
        environments to reduce the risk of a compromise in one infrastructure environment
        from laterally affecting other infrastructure environments?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-17
      name: Periodic Review of Account Privileges
      description: Mechanisms exist to periodically-review the privileges assigned
        to individuals and service accounts to validate the need for such privileges
        and reassign or remove unnecessary privileges, as necessary.
      annotation: Does the organization periodically-review the privileges assigned
        to individuals and service accounts to validate the need for such privileges
        and reassign or remove unnecessary privileges, as necessary?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-18
      name: User Responsibilities for Account Management
      description: Mechanisms exist to compel users to follow accepted practices in
        the use of authentication mechanisms (e.g., passwords, passphrases, physical
        or logical security tokens, smart cards, certificates, etc.).
      annotation: Does the organization compel users to follow accepted practices
        in the use of authentication mechanisms (e.g., passwords, passphrases, physical
        or logical security tokens, smart cards, certificates, etc.)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-19
      name: Credential Sharing
      description: Mechanisms exist to prevent the sharing of generic IDs, passwords
        or other generic authentication methods.
      annotation: Does the organization prevent the sharing of generic IDs, passwords
        or other generic authentication methods?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20
      name: Access Enforcement
      description: Mechanisms exist to enforce Logical Access Control (LAC) permissions
        that conform to the principle of "least privilege."
      annotation: Does the organization enforce Logical Access Control (LAC) permissions
        that conform to the principle of "least privilege?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.1
      name: Access To Sensitive / Regulated Data
      description: Mechanisms exist to limit access to sensitive/regulated data to
        only those individuals whose job requires such access.
      annotation: Does the organization limit access to sensitive/regulated data to
        only those individuals whose job requires such access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.2
      name: Database Access
      description: Mechanisms exist to restrict access to databases containing sensitive/regulated
        data to only necessary services or those individuals whose job requires such
        access.
      annotation: Does the organization restrict access to databases containing sensitive/regulated
        data to only necessary services or those individuals whose job requires such
        access?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.3
      name: Use of Privileged Utility Programs
      description: Mechanisms exist to restrict and tightly control utility programs
        that are capable of overriding system and application controls.
      annotation: Does the organization restrict and tightly control utility programs
        that are capable of overriding system and application controls?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.4
      name: Dedicated Administrative Machines
      description: Mechanisms exist to restrict executing administrative tasks or
        tasks requiring elevated access to a dedicated machine.
      annotation: Does the organization restrict executing administrative tasks or
        tasks requiring elevated access to a dedicated machine?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.5
      name: Dual Authorization for Privileged Commands
      description: Automated mechanisms exist to enforce dual authorization for privileged
        commands.
      annotation: Does the organization use automated mechanisms to enforce dual authorization
        for privileged commands?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.6
      name: Revocation of Access Authorizations
      description: Mechanisms exist to revoke logical and physical access authorizations.
      annotation: Does the organization revoke logical and physical access authorizations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-20.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-20.7
      name: Authorized System Accounts
      description: Mechanisms exist to define and document the types of accounts allowed
        and prohibited on systems, applications and services.
      annotation: Does the organization define and document the types of accounts
        allowed and prohibited on systems, applications and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21
      name: Least Privilege
      description: Mechanisms exist to utilize the concept of least privilege, allowing
        only authorized access to processes necessary to accomplish assigned tasks
        in accordance with organizational business functions.
      annotation: Does the organization utilize the concept of least privilege, allowing
        only authorized access to processes necessary to accomplish assigned tasks
        in accordance with organizational business functions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.1
      name: Authorize Access to Security Functions
      description: Mechanisms exist to limit access to security functions to explicitly-authorized
        privileged users.
      annotation: Does the organization limit access to security functions to explicitly-authorized
        privileged users?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.2
      name: Non-Privileged Access for Non-Security Functions
      description: Mechanisms exist to prohibit privileged users from using privileged
        accounts, while performing non-security functions.
      annotation: Does the organization prohibit privileged users from using privileged
        accounts, while performing non-security functions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.3
      name: Privileged Accounts
      description: Mechanisms exist to restrict the assignment of privileged accounts
        to management-approved personnel and/or roles.
      annotation: Does the organization restrict the assignment of privileged accounts
        to management-approved personnel and/or roles?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.4
      name: Auditing Use of Privileged Functions
      description: Mechanisms exist to audit the execution of privileged functions.
      annotation: Does the organization audit the execution of privileged functions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.5
      name: Prohibit Non-Privileged Users from Executing Privileged Functions
      description: Mechanisms exist to prevent non-privileged users from executing
        privileged functions to include disabling, circumventing or altering implemented
        security safeguards / countermeasures.
      annotation: Does the organization prevent non-privileged users from executing
        privileged functions to include disabling, circumventing or altering implemented
        security safeguards / countermeasures?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.6
      name: Network Access to Privileged Commands
      description: Mechanisms exist to authorize remote access to perform privileged
        commands on critical systems or where sensitive/regulated data is stored,
        transmitted and/or processed only for compelling operational needs.
      annotation: Does the organization authorize remote access to perform privileged
        commands on critical systems or where sensitive/regulated data is stored,
        transmitted and/or processed only for compelling operational needs?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-21.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-21.7
      name: Privilege Levels for Code Execution
      description: Automated mechanisms exist to prevent applications from executing
        at higher privilege levels than the user's privileges.
      annotation: Does the organization use automated mechanisms to prevent applications
        from executing at higher privilege levels than the user's privileges?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-22
      name: Account Lockout
      description: Mechanisms exist to enforce a limit for consecutive invalid login
        attempts by a user during an organization-defined time period and automatically
        locks the account when the maximum number of unsuccessful attempts is exceeded.
      annotation: Does the organization enforce a limit for consecutive invalid login
        attempts by a user during an organization-defined time period and automatically
        locks the account when the maximum number of unsuccessful attempts is exceeded?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-23
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-23
      name: Concurrent Session Control
      description: Mechanisms exist to limit the number of concurrent sessions for
        each system account.
      annotation: Does the organization limit the number of concurrent sessions for
        each system account?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-24
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-24
      name: Session Lock
      description: Mechanisms exist to initiate a session lock after an organization-defined
        time period of inactivity, or upon receiving a request from a user and retain
        the session lock until the user reestablishes access using established identification
        and authentication methods.
      annotation: Does the organization initiate a session lock after an organization-defined
        time period of inactivity, or upon receiving a request from a user and retain
        the session lock until the user reestablishes access using established identification
        and authentication methods?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-24.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-24.1
      name: Pattern-Hiding Displays
      description: Mechanisms exist to implement pattern-hiding displays to conceal
        information previously visible on the display during the session lock.
      annotation: Does the organization implement pattern-hiding displays to conceal
        information previously visible on the display during the session lock?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-25
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-25
      name: Session Termination
      description: Automated mechanisms exist to log out users, both locally on the
        network and for remote sessions, at the end of the session or after an organization-defined
        period of inactivity.
      annotation: Does the organization use automated mechanisms to log out users,
        both locally on the network and for remote sessions, at the end of the session
        or after an organization-defined period of inactivity?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-25.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-25.1
      name: User-Initiated Logouts / Message Displays
      description: Mechanisms exist to provide a logout capability and display an
        explicit logout message to users indicating the reliable termination of the
        session.
      annotation: Does the organization provide a logout capability and display an
        explicit logout message to users indicating the reliable termination of the
        session?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-26
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-26
      name: Permitted Actions Without Identification or Authorization
      description: Mechanisms exist to identify and document the supporting rationale
        for specific user actions that can be performed on a system without identification
        or authentication.
      annotation: Does the organization identify and document the supporting rationale
        for specific user actions that can be performed on a system without identification
        or authentication?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-27
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-27
      name: Reference Monitor
      description: Mechanisms exist to implement a reference monitor that is tamperproof,
        always-invoked, small enough to be subject to analysis / testing and the completeness
        of which can be assured.
      annotation: Does the organization implement a reference monitor that is tamperproof,
        always-invoked, small enough to be subject to analysis / testing and the completeness
        of which can be assured?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-28
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-28
      name: Identity Proofing (Identity Verification)
      description: Mechanisms exist to verify the identity of a user before issuing
        authenticators or modifying access permissions.
      annotation: Does the organization verify the identity of a user before issuing
        authenticators or modifying access permissions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-28.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-28.1
      name: Management Approval For New or Changed Accounts
      description: Mechanisms exist to ensure management approvals are required for
        new accounts or changes in permissions to existing accounts.
      annotation: Does the organization ensure management approvals are required for
        new accounts or changes in permissions to existing accounts?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-28.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-28.2
      name: Identity Evidence
      description: Mechanisms exist to require evidence of individual identification
        to be presented to the registration authority.
      annotation: Does the organization require evidence of individual identification
        to be presented to the registration authority?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-28.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-28.3
      name: Identity Evidence Validation & Verification
      description: Mechanisms exist to require that the presented identity evidence
        be validated and verified through organizational-defined methods of validation
        and verification.
      annotation: Does the organization require that the presented identity evidence
        be validated and verified through organizational-defined methods of validation
        and verification?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-28.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-28.4
      name: In-Person Validation & Verification
      description: Mechanisms exist to require that the validation and verification
        of identity evidence be conducted in person before a designated registration
        authority.
      annotation: Does the organization require that the validation and verification
        of identity evidence be conducted in person before a designated registration
        authority?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-28.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-28.5
      name: Address Confirmation
      description: Mechanisms exist to require that a notice of proofing be delivered
        through an out-of-band channel to verify the user's address (physical or digital).
      annotation: Does the organization require that a notice of proofing be delivered
        through an out-of-band channel to verify the user's address (physical or digital)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac-29
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iac
      ref_id: IAC-29
      name: Attribute-Based Access Control (ABAC)
      description: Mechanisms exist to enforce Attribute-Based Access Control (ABAC)
        for policy-driven, dynamic authorizations that supports the secure sharing
        of information.
      annotation: Does the organization enforce Attribute-Based Access Control (ABAC)
        for policy-driven, dynamic authorizations that supports the secure sharing
        of information?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      assessable: false
      depth: 1
      ref_id: IRO
      name: Incident Response
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-01
      name: Incident Response Operations
      description: Mechanisms exist to implement and govern processes and documentation
        to facilitate an organization-wide response capability for cybersecurity &
        data privacy-related incidents.
      annotation: Does the organization implement and govern processes and documentation
        to facilitate an organization-wide response capability for cybersecurity &
        data privacy-related incidents?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02
      name: Incident Handling
      description: 'Mechanisms exist to cover:

        (1) Preparation;

        (2) Automated event detection or manual incident report intake;

        (3) Analysis;

        (4) Containment;

        (5) Eradication; and

        (6) Recovery.'
      annotation: "Does the organization cover:\n (1) Preparation;\n (2) Automated\
        \ event detection or manual incident report intake;\n (3) Analysis;\n (4)\
        \ Containment;\n (5) Eradication; and\n (6) Recovery?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02.1
      name: Automated Incident Handling Processes
      description: Automated mechanisms exist to support the incident handling process.
      annotation: Does the organization use automated mechanisms to support the incident
        handling process?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02.2
      name: Insider Threat Response Capability
      description: Mechanisms exist to implement and govern an insider threat program.
      annotation: Does the organization implement and govern an insider threat program?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02.3
      name: Dynamic Reconfiguration
      description: Automated mechanisms exist to dynamically reconfigure information
        system components as part of the incident response capability.
      annotation: Does the organization use automated mechanisms to dynamically reconfigure
        information system components as part of the incident response capability?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02.4
      name: Incident Classification & Prioritization
      description: Mechanisms exist to identify classes of incidents and actions to
        take to ensure the continuation of organizational missions and business functions.
      annotation: Does the organization identify classes of incidents and actions
        to take to ensure the continuation of organizational missions and business
        functions?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02.5
      name: Correlation with External Organizations
      description: Mechanisms exist to coordinate with approved third-parties to achieve
        a cross-organization perspective on incident awareness and more effective
        incident responses.
      annotation: Does the organization coordinate with approved third-parties to
        achieve a cross-organization perspective on incident awareness and more effective
        incident responses?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-02.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-02.6
      name: Automatic Disabling of System
      description: Mechanisms exist to automatically disable systems, upon detection
        of a possible incident that meets organizational criteria, which allows for
        forensic analysis to be performed.
      annotation: Does the organization automatically disable systems, upon detection
        of a possible incident that meets organizational criteria, which allows for
        forensic analysis to be performed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-03
      name: Indicators of Compromise (IOC)
      description: Mechanisms exist to define specific Indicators of Compromise (IOC)
        to identify the signs of potential cybersecurity events.
      annotation: Does the organization define specific Indicators of Compromise (IOC)
        to identify the signs of potential cybersecurity events?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-04
      name: Incident Response Plan (IRP)
      description: Mechanisms exist to maintain and make available a current and viable
        Incident Response Plan (IRP) to all stakeholders.
      annotation: Does the organization maintain and make available a current and
        viable Incident Response Plan (IRP) to all stakeholders?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-04.1
      name: Data Breach
      description: Mechanisms exist to address data breaches, or other incidents involving
        the unauthorized disclosure of sensitive or regulated data, according to applicable
        laws, regulations and contractual obligations.
      annotation: Does the organization address data breaches, or other incidents
        involving the unauthorized disclosure of sensitive or regulated data, according
        to applicable laws, regulations and contractual obligations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-04.2
      name: IRP Update
      description: Mechanisms exist to regularly review and modify incident response
        practices to incorporate lessons learned, business process changes and industry
        developments, as necessary.
      annotation: Does the organization regularly review and modify incident response
        practices to incorporate lessons learned, business process changes and industry
        developments, as necessary?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-04.3
      name: Continuous Incident Response Improvements
      description: "Mechanisms exist to use qualitative and quantitative data from\
        \ incident response testing to: \n(1) Determine the effectiveness of incident\
        \ response processes;\n(2) Continuously improve incident response processes;\
        \ and\n(3) Provide incident response measures and metrics that are accurate,\
        \ consistent, and in a reproducible format."
      annotation: "Does the organization use qualitative and quantitative data from\
        \ incident response testing to: \n (1) Determine the effectiveness of incident\
        \ response processes;\n (2) Continuously improve incident response processes;\
        \ and\n (3) Provide incident response measures and metrics that are accurate,\
        \ consistent, and in a reproducible format?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-05
      name: Incident Response Training
      description: Mechanisms exist to train personnel in their incident response
        roles and responsibilities.
      annotation: Does the organization train personnel in their incident response
        roles and responsibilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-05.1
      name: Simulated Incidents
      description: Mechanisms exist to incorporate simulated events into incident
        response training to facilitate effective response by personnel in crisis
        situations.
      annotation: Does the organization incorporate simulated events into incident
        response training to facilitate effective response by personnel in crisis
        situations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-05.2
      name: Automated Incident Response Training Environments
      description: Automated mechanisms exist to provide a more thorough and realistic
        incident response training environment.
      annotation: Does the organization use automated mechanisms to provide a more
        thorough and realistic incident response training environment?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-06
      name: Incident Response Testing
      description: Mechanisms exist to formally test incident response capabilities
        through realistic exercises to determine the operational effectiveness of
        those capabilities.
      annotation: Does the organization formally test incident response capabilities
        through realistic exercises to determine the operational effectiveness of
        those capabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-06.1
      name: Coordination with Related Plans
      description: Mechanisms exist to coordinate incident response testing with organizational
        elements responsible for related plans.
      annotation: Does the organization coordinate incident response testing with
        organizational elements responsible for related plans?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-07
      name: Integrated Security Incident Response Team (ISIRT)
      description: Mechanisms exist to establish an integrated team of cybersecurity,
        IT and business function representatives that are capable of addressing cybersecurity
        & data privacy incident response operations.
      annotation: Does the organization establish an integrated team of cybersecurity,
        IT and business function representatives that are capable of addressing cybersecurity
        & data privacy incident response operations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-08
      name: Chain of Custody & Forensics
      description: Mechanisms exist to perform digital forensics and maintain the
        integrity of the chain of custody, in accordance with applicable laws, regulations
        and industry-recognized secure practices.
      annotation: Does the organization perform digital forensics and maintain the
        integrity of the chain of custody, in accordance with applicable laws, regulations
        and industry-recognized secure practices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-09
      name: Situational Awareness For Incidents
      description: Mechanisms exist to document, monitor and report the status of
        cybersecurity & data privacy incidents to internal stakeholders all the way
        through the resolution of the incident.
      annotation: Does the organization document, monitor and report the status of
        cybersecurity & data privacy incidents to internal stakeholders all the way
        through the resolution of the incident?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-09.1
      name: Automated Tracking, Data Collection & Analysis
      description: Automated mechanisms exist to assist in the tracking, collection
        and analysis of information from actual and potential cybersecurity & data
        privacy incidents.
      annotation: Does the organization use automated mechanisms to assist in the
        tracking, collection and analysis of information from actual and potential
        cybersecurity & data privacy incidents?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-09.2
      name: Recurring Incident Analysis
      description: Mechanisms exist to periodically review incident response activities
        for the existence of recurring incidents.
      annotation: Does the organization periodically review incident response activities
        for the existence of recurring incidents?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-10
      name: Incident Stakeholder Reporting
      description: "Mechanisms exist to timely-report incidents to applicable:\n(1)\
        \ Internal stakeholders; \n(2) Affected clients & third-parties; and\n(3)\
        \ Regulatory authorities."
      annotation: "Does the organization timely-report incidents to applicable:\n\
        \ (1) Internal stakeholders; \n (2) Affected clients & third-parties; and\n\
        \ (3) Regulatory authorities?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-10.1
      name: Automated Reporting
      description: Automated mechanisms exist to assist in the reporting of cybersecurity
        & data privacy incidents.
      annotation: Does the organization use automated mechanisms to assist in the
        reporting of cybersecurity & data privacy incidents?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-10.2
      name: Cyber Incident Reporting for Sensitive / Regulated Data
      description: Mechanisms exist to report sensitive/regulated data incidents in
        a timely manner.
      annotation: Does the organization report sensitive/regulated data incidents
        in a timely manner?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-10.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-10.3
      name: Vulnerabilities Related To Incidents
      description: Mechanisms exist to report system vulnerabilities associated with
        reported cybersecurity & data privacy incidents to organization-defined personnel
        or roles.
      annotation: Does the organization report system vulnerabilities associated with
        reported cybersecurity & data privacy incidents to organization-defined personnel
        or roles?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-10.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-10.4
      name: Supply Chain Coordination
      description: Mechanisms exist to provide cybersecurity & data privacy incident
        information to the provider of the product or service and other organizations
        involved in the supply chain for systems or system components related to the
        incident.
      annotation: Does the organization provide cybersecurity & data privacy incident
        information to the provider of the product or service and other organizations
        involved in the supply chain for systems or system components related to the
        incident?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-10.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-10.5
      name: Serious Incident Reporting
      description: 'Mechanisms exist to report any serious incident involving the
        organization''s systems, applications and/or services to relevant authorities
        in the locality where the incident occurred, in accordance with mandatory
        reporting:

        (1) Requirements; and

        (2) Timelines.'
      annotation: 'Does the organization report any serious incident involving the
        organization''s systems, applications and/or services to relevant authorities
        in the locality where the incident occurred, in accordance with mandatory
        reporting:

        (1) Requirements; and

        (2) Timelines?'
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-11
      name: Incident Reporting Assistance
      description: Mechanisms exist to provide incident response advice and assistance
        to users of systems for the handling and reporting of actual and potential
        cybersecurity & data privacy incidents.
      annotation: Does the organization provide incident response advice and assistance
        to users of systems for the handling and reporting of actual and potential
        cybersecurity & data privacy incidents?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-11.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-11.1
      name: Automation Support of Availability of Information / Support
      description: Automated mechanisms exist to increase the availability of incident
        response-related information and support.
      annotation: Does the organization use automated mechanisms to increase the availability
        of incident response-related information and support?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-11.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-11.2
      name: Coordination With External Providers
      description: Mechanisms exist to establish a direct, cooperative relationship
        between the organization's incident response capability and external service
        providers.
      annotation: Does the organization establish a direct, cooperative relationship
        between its incident response capability and external service providers?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-12
      name: Sensitive / Regulated Data Spill Response
      description: Mechanisms exist to respond to sensitive /regulated data spills.
      annotation: Does the organization respond to sensitive /regulated data spills?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-12.1
      name: Sensitive / Regulated Data Spill Responsible Personnel
      description: Mechanisms exist to formally assign personnel or roles with responsibility
        for responding to sensitive /regulated data spills.
      annotation: Does the organization formally assign personnel or roles with responsibility
        for responding to sensitive /regulated data spills?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-12.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-12.2
      name: Sensitive / Regulated Data Spill Training
      description: Mechanisms exist to ensure incident response training material
        provides coverage for sensitive /regulated data spillage response.
      annotation: Does the organization ensure incident response training material
        provides coverage for sensitive /regulated data spillage response?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-12.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-12.3
      name: Post-Sensitive / Regulated Data Spill Operations
      description: Mechanisms exist to ensure that organizational personnel impacted
        by sensitive /regulated data spills can continue to carry out assigned tasks
        while contaminated systems are undergoing corrective actions.
      annotation: Does the organization ensure that organizational personnel impacted
        by sensitive /regulated data spills can continue to carry out assigned tasks
        while contaminated systems are undergoing corrective actions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-12.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-12.4
      name: Sensitive / Regulated Data Exposure to Unauthorized Personnel
      description: Mechanisms exist to address security safeguards for personnel exposed
        to sensitive /regulated data that is not within their assigned access authorizations.
      annotation: Does the organization address security safeguards for personnel
        exposed to sensitive /regulated data that is not within their assigned access
        authorizations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-13
      name: Root Cause Analysis (RCA) & Lessons Learned
      description: Mechanisms exist to incorporate lessons learned from analyzing
        and resolving cybersecurity & data privacy incidents to reduce the likelihood
        or impact of future incidents.
      annotation: Does the organization incorporate lessons learned from analyzing
        and resolving cybersecurity & data privacy incidents to reduce the likelihood
        or impact of future incidents?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-14
      name: Regulatory & Law Enforcement Contacts
      description: Mechanisms exist to maintain incident response contacts with applicable
        regulatory and law enforcement agencies.
      annotation: Does the organization maintain incident response contacts with applicable
        regulatory and law enforcement agencies?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-15
      name: Detonation Chambers (Sandboxes)
      description: Mechanisms exist to utilize a detonation chamber capability to
        detect and/or block potentially-malicious files and email attachments.
      annotation: Does the organization utilize a detonation chamber capability to
        detect and/or block potentially-malicious files and email attachments?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iro
      ref_id: IRO-16
      name: Public Relations & Reputation Repair
      description: Mechanisms exist to proactively manage public relations associated
        with incidents and employ appropriate measures to prevent further reputational
        damage and develop plans to repair any damage to the organization's reputation.
      annotation: Does the organization proactively manage public relations associated
        with incidents and employ appropriate measures to prevent further reputational
        damage and develop plans to repair any damage to its reputation?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      assessable: false
      depth: 1
      ref_id: IAO
      name: Information Assurance
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-01
      name: Information Assurance (IA) Operations
      description: Mechanisms exist to facilitate the implementation of cybersecurity
        & data privacy assessment and authorization controls.
      annotation: Does the organization facilitate the implementation of cybersecurity
        & data privacy assessment and authorization controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-01.1
      name: Assessment Boundaries
      description: Mechanisms exist to establish the scope of assessments by defining
        the assessment boundary, according to people, processes and technology that
        directly or indirectly impact the confidentiality, integrity, availability
        and safety of the data and systems under review.
      annotation: Does the organization establish the scope of assessments by defining
        the assessment boundary, according to people, processes and technology that
        directly or indirectly impact the confidentiality, integrity, availability
        and safety of the data and systems under review?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-02
      name: Assessments
      description: Mechanisms exist to formally assess the cybersecurity & data privacy
        controls in systems, applications and services through Information Assurance
        Program (IAP) activities to determine the extent to which the controls are
        implemented correctly, operating as intended and producing the desired outcome
        with respect to meeting expected requirements.
      annotation: Does the organization formally assess the cybersecurity & data privacy
        controls in systems, applications and services through Information Assurance
        Program (IAP) activities to determine the extent to which the controls are
        implemented correctly, operating as intended and producing the desired outcome
        with respect to meeting expected requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-02.1
      name: Assessor Independence
      description: Mechanisms exist to ensure assessors or assessment teams have the
        appropriate independence to conduct cybersecurity & data privacy control assessments.
      annotation: Does the organization ensure assessors or assessment teams have
        the appropriate independence to conduct cybersecurity & data privacy control
        assessments?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-02.2
      name: Specialized Assessments
      description: "Mechanisms exist to conduct specialized assessments for: \n(1)\
        \ Statutory, regulatory and contractual compliance obligations;\n(2) Monitoring\
        \ capabilities; \n(3) Mobile devices;\n(4) Databases;\n(5) Application security;\n\
        (6) Embedded technologies (e.g., IoT, OT, etc.);\n(7) Vulnerability management;\
        \ \n(8) Malicious code; \n(9) Insider threats;\n(10) Performance/load testing;\
        \ and/or\n(11) Artificial Intelligence and Autonomous Technologies (AAT)."
      annotation: "Does the organization conduct specialized assessments for: \n (1)\
        \ Statutory, regulatory and contractual compliance obligations;\n (2) Monitoring\
        \ capabilities; \n (3) Mobile devices;\n (4) Databases;\n (5) Application\
        \ security;\n (6) Embedded technologies (e.g., IoT, OT, etc.);\n (7) Vulnerability\
        \ management; \n (8) Malicious code; \n (9) Insider threats;\n (10) Performance/load\
        \ testing; and/or\n (11) Artificial Intelligence and Autonomous Technologies\
        \ (AAT) testing?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-02.3
      name: Third-Party Assessments
      description: Mechanisms exist to accept and respond to the results of external
        assessments that are performed by impartial, external organizations.
      annotation: Does the organization accept and respond to the results of external
        assessments that are performed by impartial, external organizations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-02.4
      name: Security Assessment Report (SAR)
      description: Mechanisms exist to produce a Security Assessment Report (SAR)
        at the conclusion of a security assessment to certify the results of the assessment
        and assist with any remediation actions.
      annotation: Does the organization produce a Security Assessment Report (SAR)
        at the conclusion of a security assessment to certify the results of the assessment
        and assist with any remediation actions?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-03
      name: System Security & Privacy Plan (SSPP)
      description: Mechanisms exist to generate System Security & Privacy Plans (SSPPs),
        or similar document repositories, to identify and maintain key architectural
        information on each critical system, application or service, as well as influence
        inputs, entities, systems, applications and processes, providing a historical
        record of the data and its origins.
      annotation: Does the organization generate System Security & Privacy Plans (SSPPs),
        or similar document repositories, to identify and maintain key architectural
        information on each critical system, application or service, as well as influence
        inputs, entities, systems, applications and processes, providing a historical
        record of the data and its origins?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-03.1
      name: Plan / Coordinate with Other Organizational Entities
      description: Mechanisms exist to plan and coordinate Information Assurance Program
        (IAP) activities with affected stakeholders before conducting such activities
        in order to reduce the potential impact on operations.
      annotation: Does the organization plan and coordinate Information Assurance
        Program (IAP) activities with affected stakeholders before conducting such
        activities in order to reduce the potential impact on operations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-03.2
      name: Adequate Security for Sensitive / Regulated Data In Support of Contracts
      description: Mechanisms exist to protect sensitive / regulated data that is
        collected, developed, received, transmitted, used or stored in support of
        the performance of a contract.
      annotation: Does the organization protect sensitive / regulated data that is
        collected, developed, received, transmitted, used or stored in support of
        the performance of a contract?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-04
      name: Threat Analysis & Flaw Remediation During Development
      description: Mechanisms exist to require system developers and integrators to
        create and execute a Security Testing and Evaluation (ST&E) plan, or similar
        process, to identify and remediate flaws during development.
      annotation: Does the organization require system developers and integrators
        to create and execute a Security Testing and Evaluation (ST&E) plan to identify
        and remediate flaws during development?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-05
      name: Plan of Action & Milestones (POA&M)
      description: Mechanisms exist to generate a Plan of Action and Milestones (POA&M),
        or similar risk register, to document planned remedial actions to correct
        weaknesses or deficiencies noted during the assessment of the security controls
        and to reduce or eliminate known vulnerabilities.
      annotation: Does the organization generate a Plan of Action and Milestones (POA&M),
        or similar risk register, to document planned remedial actions to correct
        weaknesses or deficiencies noted during the assessment of the security controls
        and to reduce or eliminate known vulnerabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-05.1
      name: Plan of Action & Milestones (POA&M) Automation
      description: Automated mechanisms exist to help ensure the Plan of Action and
        Milestones (POA&M), or similar risk register, is accurate, up-to-date and
        readily-available.
      annotation: Does the organization use automated mechanisms to help ensure the
        Plan of Action and Milestones (POA&M), or similar risk register, is accurate,
        up-to-date and readily-available?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-06
      name: Technical Verification
      description: Mechanisms exist to perform Information Assurance Program (IAP)
        activities to evaluate the design, implementation and effectiveness of technical
        cybersecurity & data privacy controls.
      annotation: Does the organization perform Information Assurance Program (IAP)
        activities to evaluate the design, implementation and effectiveness of technical
        cybersecurity & data privacy controls?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:iao
      ref_id: IAO-07
      name: Security Authorization
      description: Mechanisms exist to ensure systems, projects and services are officially
        authorized prior to "go live" in a production environment.
      annotation: Does the organization ensure systems, projects and services are
        officially authorized prior to "go live" in a production environment?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      assessable: false
      depth: 1
      ref_id: MNT
      name: Maintenance
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-01
      name: Maintenance Operations
      description: Mechanisms exist to develop, disseminate, review & update procedures
        to facilitate the implementation of maintenance controls across the enterprise.
      annotation: Does the organization develop, disseminate, review & update procedures
        to facilitate the implementation of maintenance controls across the enterprise?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-02
      name: Controlled Maintenance
      description: Mechanisms exist to conduct controlled maintenance activities throughout
        the lifecycle of the system, application or service.
      annotation: Does the organization conduct controlled maintenance activities
        throughout the lifecycle of the system, application or service?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-02.1
      name: Automated Maintenance Activities
      description: Automated mechanisms exist to schedule, conduct and document maintenance
        and repairs.
      annotation: Does the organization use automated mechanisms to schedule, conduct
        and document maintenance and repairs?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-03
      name: Timely Maintenance
      description: Mechanisms exist to obtain maintenance support and/or spare parts
        for systems within a defined Recovery Time Objective (RTO).
      annotation: Does the organization obtain maintenance support and/or spare parts
        for systems within a defined Recovery Time Objective (RTO)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-03.1
      name: Preventative Maintenance
      description: Mechanisms exist to perform preventive maintenance on critical
        systems, applications and services.
      annotation: Does the organization perform preventive maintenance on critical
        systems, applications and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-03.2
      name: Predictive Maintenance
      description: Mechanisms exist to perform predictive maintenance on critical
        systems, applications and services.
      annotation: Does the organization perform predictive maintenance on critical
        systems, applications and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-03.3
      name: Automated Support For Predictive Maintenance
      description: Automated mechanisms exist to transfer predictive maintenance data
        to a computerized maintenance management system.
      annotation: Does the organization use automated mechanisms to transfer predictive
        maintenance data to a computerized maintenance management system?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-04
      name: Maintenance Tools
      description: Mechanisms exist to control and monitor the use of system maintenance
        tools.
      annotation: Does the organization control and monitor the use of system maintenance
        tools?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-04.1
      name: Inspect Tools
      description: Mechanisms exist to inspect maintenance tools carried into a facility
        by maintenance personnel for improper or unauthorized modifications.
      annotation: Does the organization inspect maintenance tools carried into a facility
        by maintenance personnel for improper or unauthorized modifications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-04.2
      name: Inspect Media
      description: Mechanisms exist to check media containing diagnostic and test
        programs for malicious code before the media are used.
      annotation: Does the organization check media containing diagnostic and test
        programs for malicious code before the media are used?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-04.3
      name: Prevent Unauthorized Removal
      description: Mechanisms exist to prevent or control the removal of equipment
        undergoing maintenance that containing organizational information.
      annotation: Does the organization prevent or control the removal of equipment
        undergoing maintenance that containing organizational information?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-04.4
      name: Restrict Tool Usage
      description: Automated mechanisms exist to restrict the use of maintenance tools
        to authorized maintenance personnel and/or roles.
      annotation: Does the organization use automated mechanisms to restrict the use
        of maintenance tools to authorized maintenance personnel and/or roles?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05
      name: Remote Maintenance
      description: Mechanisms exist to authorize, monitor and control remote, non-local
        maintenance and diagnostic activities.
      annotation: Does the organization authorize, monitor and control remote, non-local
        maintenance and diagnostic activities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.1
      name: Auditing Remote Maintenance
      description: Mechanisms exist to audit remote, non-local maintenance and diagnostic
        sessions, as well as review the maintenance action performed during remote
        maintenance sessions.
      annotation: Does the organization audit remote, non-local maintenance and diagnostic
        sessions, as well as review the maintenance action performed during remote
        maintenance sessions?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.2
      name: Remote Maintenance Notifications
      description: Mechanisms exist to require maintenance personnel to notify affected
        stakeholders when remote, non-local maintenance is planned (e.g., date/time).
      annotation: Does the organization require maintenance personnel to notify affected
        stakeholders when remote, non-local maintenance is planned (e.g., date/time)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.3
      name: Remote Maintenance Cryptographic Protection
      description: Cryptographic mechanisms exist to protect the integrity and confidentiality
        of remote, non-local maintenance and diagnostic communications.
      annotation: Are cryptographic mechanisms utilized to protect the integrity and
        confidentiality of remote, non-local maintenance and diagnostic communications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.4
      name: Remote Maintenance Disconnect Verification
      description: Mechanisms exist to provide remote disconnect verification to ensure
        remote, non-local maintenance and diagnostic sessions are properly terminated.
      annotation: Does the organization provide remote disconnect verification to
        ensure remote, non-local maintenance and diagnostic sessions are properly
        terminated?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.5
      name: Remote Maintenance Pre-Approval
      description: Mechanisms exist to require maintenance personnel to obtain pre-approval
        and scheduling for remote, non-local maintenance sessions.
      annotation: Does the organization require maintenance personnel to obtain pre-approval
        and scheduling for remote, non-local maintenance sessions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.6
      name: Remote Maintenance Comparable Security & Sanitization
      description: Mechanisms exist to require systems performing remote, non-local
        maintenance and / or diagnostic services implement a security capability comparable
        to the capability implemented on the system being serviced.
      annotation: Does the organization require systems performing remote, non-local
        maintenance and / or diagnostic services implement a security capability comparable
        to the capability implemented on the system being serviced?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-05.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-05.7
      name: Separation of Maintenance Sessions
      description: Mechanisms exist to protect maintenance sessions through replay-resistant
        sessions that are physically or logically separated communications paths from
        other network sessions.
      annotation: Does the organization protect maintenance sessions through replay-resistant
        sessions that are physically or logically separated communications paths from
        other network sessions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-06
      name: Authorized Maintenance Personnel
      description: Mechanisms exist to maintain a current list of authorized maintenance
        organizations or personnel.
      annotation: Does the organization maintain a current list of authorized maintenance
        organizations or personnel?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-06.1
      name: Maintenance Personnel Without Appropriate Access
      description: Mechanisms exist to ensure the risks associated with maintenance
        personnel who do not have appropriate access authorizations, clearances or
        formal access approvals are appropriately mitigated.
      annotation: Does the organization ensure the risks associated with maintenance
        personnel who do not have appropriate access authorizations, clearances or
        formal access approvals are appropriately mitigated?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-06.2
      name: Non-System Related Maintenance
      description: Mechanisms exist to ensure that non-escorted personnel performing
        non-IT maintenance activities in the physical proximity of IT systems have
        required access authorizations.
      annotation: Does the organization ensure that non-escorted personnel performing
        non-IT maintenance activities in the physical proximity of IT systems have
        required access authorizations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-07
      name: Maintain Configuration Control During Maintenance
      description: Mechanisms exist to maintain proper physical security and configuration
        control over technology assets awaiting service or repair.
      annotation: Does the organization maintain proper physical security and configuration
        control over technology assets awaiting service or repair?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-08
      name: Field Maintenance
      description: Mechanisms exist to securely conduct field maintenance on geographically
        deployed assets.
      annotation: Does the organization securely conduct field maintenance on geographically
        deployed assets?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-09
      name: Off-Site Maintenance
      description: Mechanisms exist to ensure off-site maintenance activities are
        conducted securely and the asset(s) undergoing maintenance actions are secured
        during physical transfer and storage while off-site.
      annotation: Does the organization ensure off-site maintenance activities are
        conducted securely and the asset(s) undergoing maintenance actions are secured
        during physical transfer and storage while off-site?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-10
      name: Maintenance Validation
      description: Mechanisms exist to validate maintenance activities were appropriately
        performed according to the work order and that security controls are operational.
      annotation: Does the organization validate maintenance activities were appropriately
        performed according to the work order and that security controls are operational?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mnt
      ref_id: MNT-11
      name: Maintenance Monitoring
      description: Mechanisms exist to maintain situational awareness of the quality
        and reliability of systems and components through tracking maintenance activities
        and component failure rates.
      annotation: Does the organization maintain situational awareness of the quality
        and reliability of systems and components through tracking maintenance activities
        and component failure rates?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      assessable: false
      depth: 1
      ref_id: MDM
      name: Mobile Device Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-01
      name: Centralized Management Of Mobile Devices
      description: Mechanisms exist to implement and govern Mobile Device Management
        (MDM) controls.
      annotation: Does the organization implement and govern Mobile Device Management
        (MDM) controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-02
      name: Access Control For Mobile Devices
      description: Mechanisms exist to enforce access control requirements for the
        connection of mobile devices to organizational systems.
      annotation: Does the organization enforce access control requirements for the
        connection of mobile devices to organizational systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-03
      name: Full Device & Container-Based Encryption
      description: Cryptographic mechanisms exist to protect the confidentiality and
        integrity of information on mobile devices through full-device or container
        encryption.
      annotation: Are cryptographic mechanisms utilized to protect the confidentiality
        and integrity of information on mobile devices through full-device or container
        encryption?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-04
      name: Mobile Device Tampering
      description: Mechanisms exist to protect mobile devices from tampering through
        inspecting devices returning from locations that the organization deems to
        be of significant risk, prior to the device being connected to the organization's
        network.
      annotation: Does the organization protect mobile devices from tampering through
        inspecting devices returning from locations that the organization deems to
        be of significant risk, prior to the device being connected to its network?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-05
      name: Remote Purging
      description: Mechanisms exist to remotely purge selected information from mobile
        devices.
      annotation: Does the organization remotely purge selected information from mobile
        devices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-06
      name: Personally-Owned Mobile Devices
      description: Mechanisms exist to restrict the connection of personally-owned,
        mobile devices to organizational systems and networks.
      annotation: Does the organization restrict the connection of personally-owned,
        mobile devices to organizational systems and networks?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-07
      name: Organization-Owned Mobile Devices
      description: Mechanisms exist to prohibit the installation of non-approved applications
        or approved applications not obtained through the organization-approved application
        store.
      annotation: Does the organization prohibit the installation of non-approved
        applications or approved applications not obtained through the organization-approved
        application store?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-08
      name: Mobile Device Data Retention Limitations
      description: Mechanisms exist to limit data retention on mobile devices to the
        smallest usable dataset and timeframe.
      annotation: Does the organization limit data retention on mobile devices to
        the smallest usable dataset and timeframe?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-09
      name: Mobile Device Geofencing
      description: Mechanisms exist to restrict the functionality of mobile devices
        based on geographic location.
      annotation: Does the organization restrict the functionality of mobile devices
        based on geographic location?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-10
      name: Separate Mobile Device Profiles
      description: Mechanisms exist to enforce a separate device workspace on applicable
        mobile devices to separate work-related and personal-related applications
        and data.
      annotation: Does the organization enforce a separate device workspace on applicable
        mobile devices to separate work-related and personal-related applications
        and data?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:mdm
      ref_id: MDM-11
      name: Restricting Access To Authorized Devices
      description: Mechanisms exist to restrict the connectivity of unauthorized mobile
        devices from communicating with systems, applications and services.
      annotation: Does the organization restrict the connectivity of unauthorized
        mobile devices from communicating with systems, applications and services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      assessable: false
      depth: 1
      ref_id: NET
      name: Network Security
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-01
      name: Network Security Controls (NSC)
      description: Mechanisms exist to develop, govern & update procedures to facilitate
        the implementation of Network Security Controls (NSC).
      annotation: Does the organization develop, govern & update procedures to facilitate
        the implementation of Network Security Controls (NSC)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-01.1
      name: Zero Trust Architecture (ZTA)
      description: Mechanisms exist to treat all users and devices as potential threats
        and prevent access to data and resources until the users can be properly authenticated
        and their access authorized.
      annotation: Does the organization treat all users and devices as potential threats
        and prevent access to data and resources until the users can be properly authenticated
        and their access authorized?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-02
      name: Layered Network Defenses
      description: Mechanisms exist to implement security functions as a layered structure
        that minimizes interactions between layers of the design and avoids any dependence
        by lower layers on the functionality or correctness of higher layers.
      annotation: Does the organization implement security functions as a layered
        structure that minimizes interactions between layers of the design and avoids
        any dependence by lower layers on the functionality or correctness of higher
        layers?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-02.1
      name: Denial of Service (DoS) Protection
      description: Automated mechanisms exist to protect against or limit the effects
        of denial of service attacks.
      annotation: Does the organization use automated mechanisms to protect against
        or limit the effects of denial of service attacks?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-02.2
      name: Guest Networks
      description: Mechanisms exist to implement and manage a secure guest network.
      annotation: Does the organization implement and manage a secure guest network?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-02.3
      name: Cross Domain Solution (CDS)
      description: Mechanisms exist to implement a Cross Domain Solution (CDS) to
        mitigate the specific security risks of accessing or transferring information
        between security domains.
      annotation: Does the organization implement a Cross Domain Solution (CDS) to
        mitigate the specific security risks of accessing or transferring information
        between security domains?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03
      name: Boundary Protection
      description: Mechanisms exist to monitor and control communications at the external
        network boundary and at key internal boundaries within the network.
      annotation: Does the organization monitor and control communications at the
        external network boundary and at key internal boundaries within the network?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.1
      name: Limit Network Connections
      description: Mechanisms exist to limit the number of concurrent external network
        connections to its systems.
      annotation: Does the organization limit the number of concurrent external network
        connections to its systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.2
      name: External Telecommunications Services
      description: Mechanisms exist to maintain a managed interface for each external
        telecommunication service that protects the confidentiality and integrity
        of the information being transmitted across each interface.
      annotation: Does the organization maintain a managed interface for each external
        telecommunication service that protects the confidentiality and integrity
        of the information being transmitted across each interface?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.3
      name: Prevent Discovery of Internal Information
      description: Mechanisms exist to prevent the public disclosure of internal network
        information.
      annotation: Does the organization prevent the public disclosure of internal
        network information?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.4
      name: Personal Data (PD)
      description: Mechanisms exist to apply network-based processing rules to data
        elements of Personal Data (PD).
      annotation: Does the organization apply network-based processing rules to data
        elements of Personal Data (PD)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.5
      name: Prevent Unauthorized Exfiltration
      description: Automated mechanisms exist to prevent the unauthorized exfiltration
        of sensitive/regulated data across managed interfaces.
      annotation: Does the organization use automated mechanisms to prevent the unauthorized
        exfiltration of sensitive/regulated data across managed interfaces?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.6
      name: Dynamic Isolation & Segregation (Sandboxing)
      description: Automated mechanisms exist to dynamically isolate (e.g., sandbox)
        untrusted components during runtime, where the component is isolated in a
        fault-contained environment but it can still collaborate with the application.
      annotation: Does the organization use automated mechanisms to dynamically isolate
        (e.g., sandbox) untrusted components during runtime, where the component is
        isolated in a fault-contained environment but it can still collaborate with
        the application?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.7
      name: Isolation of Information System Components
      description: Mechanisms exist to employ boundary protections to isolate systems,
        services and processes that support critical missions and/or business functions.
      annotation: Does the organization employ boundary protections to isolate systems,
        services and processes that support critical missions and/or business functions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-03.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-03.8
      name: Separate Subnet for Connecting to Different Security Domains
      description: Mechanisms exist to implement separate network addresses (e.g.,
        different subnets) to connect to systems in different security domains.
      annotation: Does the organization implement separate network addresses (e.g.,
        different subnets) to connect to systems in different security domains?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04
      name: "Data Flow Enforcement \u2013 Access Control Lists (ACLs)"
      description: Mechanisms exist to implement and govern Access Control Lists (ACLs)
        to provide data flow enforcement that explicitly restrict network traffic
        to only what is authorized.
      annotation: Does the organization implement and govern Access Control Lists
        (ACLs) to provide data flow enforcement that explicitly restrict network traffic
        to only what is authorized?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.1
      name: Deny Traffic by Default & Allow Traffic by Exception
      description: Mechanisms exist to configure firewall and router configurations
        to deny network traffic by default and allow network traffic by exception
        (e.g., deny all, permit by exception).
      annotation: Does the organization configure firewall and router configurations
        to deny network traffic by default and allow network traffic by exception
        (e.g., deny all, permit by exception)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.2
      name: Object Security Attributes
      description: Mechanisms exist to associate security attributes with information,
        source and destination objects to enforce defined information flow control
        configurations as a basis for flow control decisions.
      annotation: Does the organization associate security attributes with information,
        source and destination objects to enforce defined information flow control
        configurations as a basis for flow control decisions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.3
      name: Content Check for Encrypted Data
      description: Mechanisms exist to prevent encrypted data from bypassing content-checking
        mechanisms.
      annotation: Does the organization prevent encrypted data from bypassing content-checking
        mechanisms?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.4
      name: Embedded Data Types
      description: Mechanisms exist to enforce limitations on embedding data within
        other data types.
      annotation: Does the organization enforce limitations on embedding data within
        other data types?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.5
      name: Metadata
      description: Mechanisms exist to enforce information flow controls based on
        metadata.
      annotation: Does the organization enforce information flow controls based on
        metadata?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.6
      name: Human Reviews
      description: Mechanisms exist to enforce the use of human reviews for Access
        Control Lists (ACLs) and similar rulesets on a routine basis.
      annotation: Does the organization enforce the use of human reviews for Access
        Control Lists (ACLs) and similar rulesets on a routine basis?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.7
      name: Policy Decision Point (PDP)
      description: Automated mechanisms exist to evaluate access requests against
        established criteria to dynamically and uniformly enforce access rights and
        permissions.
      annotation: Does the organization evaluate access requests against established
        criteria to dynamically and uniformly enforce access rights and permissions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.8
      name: Data Type Identifiers
      description: Automated mechanisms exist to utilize data type identifiers to
        validate data essential for information flow decisions when transferring information
        between different security domains.
      annotation: Does the organization use automated mechanisms to utilize data type
        identifiers to validate data essential for information flow decisions when
        transferring information between different security domains?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.9
      name: Decomposition Into Policy-Related Subcomponents
      description: Automated mechanisms exist to decompose information into policy-relevant
        subcomponents for submission to policy enforcement mechanisms, when transferring
        information between different security domains.
      annotation: Does the organization use automated mechanisms to decompose information
        into policy-relevant subcomponents for submission to policy enforcement mechanisms,
        when transferring information between different security domains?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.10
      name: Detection of Unsanctioned Information
      description: Automated mechanisms exist to implement security policy filters
        requiring fully enumerated formats that restrict data structure and content,
        when transferring information between different security domains.
      annotation: Does the organization use automated mechanisms to implement security
        policy filters requiring fully enumerated formats that restrict data structure
        and content, when transferring information between different security domains?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.11
      name: Approved Solutions
      description: Automated mechanisms exist to examine information for the presence
        of unsanctioned information and prohibits the transfer of such information,
        when transferring information between different security domains.
      annotation: Does the organization use automated mechanisms to examine information
        for the presence of unsanctioned information and prohibits the transfer of
        such information, when transferring information between different security
        domains?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.12
      name: Cross Domain Authentication
      description: Automated mechanisms exist to uniquely identify and authenticate
        source and destination points for information transfer.
      annotation: Does the organization use automated mechanisms to uniquely identify
        and authenticate source and destination points for information transfer?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.13
      name: Metadata Validation
      description: Automated mechanisms exist to apply cybersecurity and/or data privacy
        filters on metadata.
      annotation: Does the organization use automated mechanisms to apply cybersecurity
        and/or data privacy filters on metadata?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-04.14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-04.14
      name: Application Proxy
      description: "Mechanisms exist to terminate, inspect, control and reinitiate\
        \ application traffic, regardless of the user\u2019s location or the security\
        \ posture of the surrounding network."
      annotation: "Does the organization maintain visibility and control over application\
        \ traffic, regardless of the user\u2019s location or the security posture\
        \ of the surrounding network?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-05
      name: Interconnection Security Agreements (ISAs)
      description: Mechanisms exist to authorize connections from systems to other
        systems using Interconnection Security Agreements (ISAs), or similar methods,
        that document, for each interconnection, the interface characteristics, cybersecurity
        & data privacy requirements and the nature of the information communicated.
      annotation: Does the organization authorize connections from systems to other
        systems using Interconnection Security Agreements (ISAs), or similar methods,
        that document, for each interconnection, the interface characteristics, cybersecurity
        & data privacy requirements and the nature of the information communicated?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-05.1
      name: External System Connections
      description: Mechanisms exist to prohibit the direct connection of a sensitive
        system to an external network without the use of an organization-defined boundary
        protection device.
      annotation: Does the organization prohibit the direct connection of a sensitive
        system to an external network without the use of an organization-defined boundary
        protection device?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-05.2
      name: Internal System Connections
      description: Mechanisms exist to control internal system connections through
        authorizing internal connections of systems and documenting, for each internal
        connection, the interface characteristics, security requirements and the nature
        of the information communicated.
      annotation: Does the organization control internal system connections through
        authorizing internal connections of systems and documenting, for each internal
        connection, the interface characteristics, security requirements and the nature
        of the information communicated?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06
      name: Network Segmentation (macrosegementation)
      description: Mechanisms exist to ensure network architecture utilizes network
        segmentation to isolate systems, applications and services to protect from
        other network resources.
      annotation: Does the organization ensure network architecture utilizes network
        segmentation to isolate systems, applications and services to protect from
        other network resources?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.1
      name: Security Management Subnets
      description: Mechanisms exist to implement security management subnets to isolate
        security tools and support components from other internal system components
        by implementing separate subnetworks with managed interfaces to other components
        of the system.
      annotation: Does the organization implement security management subnets to isolate
        security tools and support components from other internal system components
        by implementing separate subnetworks with managed interfaces to other components
        of the system?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.2
      name: Virtual Local Area Network (VLAN) Separation
      description: Mechanisms exist to enable Virtual Local Area Networks (VLANs)
        to limit the ability of devices on a network to directly communicate with
        other devices on the subnet and limit an attacker's ability to laterally move
        to compromise neighboring systems.
      annotation: Does the organization enable Virtual Local Area Networks (VLANs)
        to limit the ability of devices on a network to directly communicate with
        other devices on the subnet and limit an attacker's ability to laterally move
        to compromise neighboring systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.3
      name: Sensitive / Regulated Data Enclave (Secure Zone)
      description: Mechanisms exist to implement segmentation controls to restrict
        inbound and outbound connectivity for sensitive / regulated data enclaves
        (secure zones).
      annotation: Does the organization implement segmentation controls to restrict
        inbound and outbound connectivity for sensitive / regulated data enclaves
        (secure zones)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.4
      name: Segregation From Enterprise Services
      description: Mechanisms exist to isolate sensitive / regulated data enclaves
        (secure zones) from corporate-provided IT resources by providing enclave-specific
        IT services (e.g., directory services, DNS, NTP, ITAM, antimalware, patch
        management, etc.) to those isolated network segments.
      annotation: Does the organization isolate sensitive / regulated data enclaves
        (secure zones) from corporate-provided IT resources by providing enclave-specific
        IT services (e.g., directory services, DNS, NTP, ITAM, antimalware, patch
        management, etc.) to those isolated network segments?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.5
      name: Direct Internet Access Restrictions
      description: Mechanisms exist to prohibit, or strictly-control, Internet access
        from sensitive / regulated data enclaves (secure zones).
      annotation: Does the organization prohibit, or strictly-control, Internet access
        from sensitive / regulated data enclaves (secure zones)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.6
      name: Microsegmentation
      description: Automated mechanisms exist to enable microsegmentation, either
        physically or virtually, to divide the network according to application and
        data workflows communications needs.
      annotation: Does the organization use automated mechanisms to enable microsegmentation,
        either physically or virtually, to divide the network according to application
        and data workflows communications needs?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-06.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-06.7
      name: Software Defined Networking (SDN)
      description: Automated mechanisms exist to enable dynamic, policy-driven network
        segmentation, access controls and traffic management with a Software Defined
        Networking (SDN) architecture.
      annotation: Does the organization enable dynamic, policy-driven network segmentation,
        access controls and traffic management?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-07
      name: Network Connection Termination
      description: Mechanisms exist to terminate network connections at the end of
        a session or after an organization-defined time period of inactivity.
      annotation: Does the organization terminate network connections at the end of
        a session or after an organization-defined time period of inactivity?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-08
      name: Network Intrusion Detection / Prevention Systems (NIDS / NIPS)
      description: Mechanisms exist to employ Network Intrusion Detection / Prevention
        Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network.
      annotation: Does the organization employ Network Intrusion Detection / Prevention
        Systems (NIDS/NIPS) to detect and/or prevent intrusions into the network?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-08.1
      name: DMZ Networks
      description: Mechanisms exist to monitor De-Militarized Zone (DMZ) network segments
        to separate untrusted networks from trusted networks.
      annotation: Does the organization monitor De-Militarized Zone (DMZ) network
        segments to separate untrusted networks from trusted networks?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-08.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-08.2
      name: Wireless Intrusion Detection / Prevention Systems (WIDS / WIPS)
      description: Mechanisms exist to monitor wireless network segments to implement
        Wireless Intrusion Detection / Prevention Systems (WIDS/WIPS) technologies.
      annotation: Does the organization monitor wireless network segments to implement
        Wireless Intrusion Detection / Prevention Systems (WIDS/WIPS) technologies?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-08.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-08.3
      name: Host Containment
      description: "Automated mechanisms exist to enforce host containment protections\
        \ that revoke or quarantine a host\u2019s access to the network."
      annotation: "Does the organization use automated mechanisms to enforce host\
        \ containment protections that revoke or quarantine a host\u2019s access to\
        \ the network?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-08.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-08.4
      name: Resource Containment
      description: "Automated mechanisms exist to enforce resource containment protections\
        \ that remove or quarantine a resource\u2019s access to other resources."
      annotation: "Does the organization use automated mechanisms to enforce resource\
        \ containment protections that remove or quarantine a resource\u2019s access\
        \ to other resources?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-09
      name: Session Integrity
      description: Mechanisms exist to protect the authenticity and integrity of communications
        sessions.
      annotation: Does the organization protect the authenticity and integrity of
        communications sessions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-09.1
      name: Invalidate Session Identifiers at Logout
      description: Automated mechanisms exist to invalidate session identifiers upon
        user logout or other session termination.
      annotation: Does the organization use automated mechanisms to invalidate session
        identifiers upon user logout or other session termination?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-09.2
      name: Unique System-Generated Session Identifiers
      description: Automated mechanisms exist to generate and recognize unique session
        identifiers for each session.
      annotation: Does the organization use automated mechanisms to generate and recognize
        unique session identifiers for each session?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-10
      name: Domain Name Service (DNS) Resolution
      description: Mechanisms exist to ensure Domain Name Service (DNS) resolution
        is designed, implemented and managed to protect the security of name / address
        resolution.
      annotation: Does the organization ensure Domain Name Service (DNS) resolution
        is designed, implemented and managed to protect the security of name / address
        resolution?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-10.1
      name: Architecture & Provisioning for Name / Address Resolution Service
      description: Mechanisms exist to ensure systems that collectively provide Domain
        Name Service (DNS) resolution service are fault-tolerant and implement internal/external
        role separation.
      annotation: Does the organization ensure systems that collectively provide Domain
        Name Service (DNS) resolution service are fault-tolerant and implement internal/external
        role separation?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-10.2
      name: Secure Name / Address Resolution Service (Recursive or Caching Resolver)
      description: Mechanisms exist to perform data origin authentication and data
        integrity verification on the Domain Name Service (DNS) resolution responses
        received from authoritative sources when requested by client systems.
      annotation: Does the organization perform data origin authentication and data
        integrity verification on the Domain Name Service (DNS) resolution responses
        received from authoritative sources when requested by client systems?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-10.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-10.3
      name: Sender Policy Framework (SPF)
      description: Mechanisms exist to validate the legitimacy of email communications
        through configuring a Domain Naming Service (DNS) Sender Policy Framework
        (SPF) record to specify the IP addresses and/or hostnames that are authorized
        to send email from the specified domain.
      annotation: Does the organization validate the legitimacy of email communications
        through configuring a Domain Naming Service (DNS) Sender Policy Framework
        (SPF) record to specify the IP addresses and/or hostnames that are authorized
        to send email from the specified domain?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-10.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-10.4
      name: Domain Registrar Security
      description: "Mechanisms exist to lock the domain name registrar to prevent\
        \ a denial of service caused by unauthorized deletion, transfer or other unauthorized\
        \ modification of a domain\u2019s registration details."
      annotation: "Does the organization lock the domain name registrar to prevent\
        \ a denial of service caused by unauthorized deletion, transfer or other unauthorized\
        \ modification of a domain\u2019s registration details?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-11
      name: Out-of-Band Channels
      description: Mechanisms exist to utilize out-of-band channels for the electronic
        transmission of information and/or the physical shipment of system components
        or devices to authorized individuals.
      annotation: Does the organization utilize out-of-band channels for the electronic
        transmission of information and/or the physical shipment of system components
        or devices to authorized individuals?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-12
      name: Safeguarding Data Over Open Networks
      description: Cryptographic mechanisms exist to implement strong cryptography
        and security protocols to safeguard sensitive/regulated data during transmission
        over open, public networks.
      annotation: Are cryptographic mechanisms utilized to implement strong cryptography
        and security protocols to safeguard sensitive/regulated data during transmission
        over open, public networks?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-12.1
      name: Wireless Link Protection
      description: Mechanisms exist to protect external and internal wireless links
        from signal parameter attacks through monitoring for unauthorized wireless
        connections, including scanning for unauthorized wireless access points and
        taking appropriate action, if an unauthorized connection is discovered.
      annotation: Does the organization protect external and internal wireless links
        from signal parameter attacks through monitoring for unauthorized wireless
        connections, including scanning for unauthorized wireless access points and
        taking appropriate action, if an unauthorized connection is discovered?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-12.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-12.2
      name: End-User Messaging Technologies
      description: Mechanisms exist to prohibit the transmission of unprotected sensitive/regulated
        data by end-user messaging technologies.
      annotation: Does the organization prohibit the transmission of unprotected sensitive/regulated
        data by end-user messaging technologies?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-13
      name: Electronic Messaging
      description: Mechanisms exist to protect the confidentiality, integrity and
        availability of electronic messaging communications.
      annotation: Does the organization protect the confidentiality, integrity and
        availability of electronic messaging communications?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14
      name: Remote Access
      description: Mechanisms exist to define, control and review organization-approved,
        secure remote access methods.
      annotation: Does the organization define, control and review organization-approved,
        secure remote access methods?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.1
      name: Automated Monitoring & Control
      description: Automated mechanisms exist to monitor and control remote access
        sessions.
      annotation: Does the organization use automated mechanisms to monitor and control
        remote access sessions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.2
      name: Protection of Confidentiality / Integrity Using Encryption
      description: Cryptographic mechanisms exist to protect the confidentiality and
        integrity of remote access sessions (e.g., VPN).
      annotation: Are cryptographic mechanisms utilized to protect the confidentiality
        and integrity of remote access sessions (e.g., VPN)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.3
      name: Managed Access Control Points
      description: Mechanisms exist to route all remote accesses through managed network
        access control points (e.g., VPN concentrator).
      annotation: Does the organization route all remote accesses through managed
        network access control points (e.g., VPN concentrator)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.4
      name: Remote Privileged Commands & Sensitive Data Access
      description: Mechanisms exist to restrict the execution of privileged commands
        and access to security-relevant information via remote access only for compelling
        operational needs.
      annotation: Does the organization restrict the execution of privileged commands
        and access to security-relevant information via remote access only for compelling
        operational needs?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.5
      name: Work From Anywhere (WFA) - Telecommuting Security
      description: Mechanisms exist to define secure telecommuting practices and govern
        remote access to systems and data for remote workers.
      annotation: Does the organization define secure telecommuting practices and
        govern remote access to systems and data for remote workers?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.6
      name: Third-Party Remote Access Governance
      description: Mechanisms exist to proactively control and monitor third-party
        accounts used to access, support, or maintain system components via remote
        access.
      annotation: Does the organization proactively control and monitor third-party
        accounts used to access, support, or maintain system components via remote
        access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.7
      name: Endpoint Security Validation
      description: Automated mechanisms exist to validate the security posture of
        the endpoint devices (e.g., software versions, patch levels, etc.) prior to
        allowing devices to connect to organizational technology assets.
      annotation: Does the organization validate the security posture of the endpoint
        devices (e.g., software versions, patch levels, etc.) prior to allowing devices
        to connect to organizational technology assets?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-14.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-14.8
      name: Expeditious Disconnect / Disable Capability
      description: Mechanisms exist to provide the capability to expeditiously disconnect
        or disable a user's remote access session.
      annotation: Does the organization provide the capability to expeditiously disconnect
        or disable a user's remote access session?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-15
      name: Wireless Networking
      description: Mechanisms exist to control authorized wireless usage and monitor
        for unauthorized wireless access.
      annotation: Does the organization control authorized wireless usage and monitor
        for unauthorized wireless access?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-15.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-15.1
      name: Authentication & Encryption
      description: "Mechanisms exist to secure Wi-Fi (e.g., IEEE 802.11) and prevent\
        \ unauthorized access by:\n(1) Authenticating devices trying to connect; and\
        \ \n(2) Encrypting transmitted data."
      annotation: "Does the organization secure Wi-Fi (e.g., IEEE 802.11) and prevent\
        \ unauthorized access by:\n (1) Authenticating devices trying to connect;\
        \ and \n (2) Encrypting transmitted data?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-15.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-15.2
      name: Disable Wireless Networking
      description: Mechanisms exist to disable unnecessary wireless networking capabilities
        that are internally embedded within system components prior to issuance to
        end users.
      annotation: Does the organization disable unnecessary wireless networking capabilities
        that are internally embedded within system components prior to issuance to
        end users?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-15.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-15.3
      name: Restrict Configuration By Users
      description: Mechanisms exist to identify and explicitly authorize users who
        are allowed to independently configure wireless networking capabilities.
      annotation: Does the organization identify and explicitly authorize users who
        are allowed to independently configure wireless networking capabilities?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-15.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-15.4
      name: Wireless Boundaries
      description: Mechanisms exist to confine wireless communications to organization-controlled
        boundaries.
      annotation: Does the organization confine wireless communications to organization-controlled
        boundaries?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-15.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-15.5
      name: Rogue Wireless Detection
      description: Mechanisms exist to test for the presence of Wireless Access Points
        (WAPs) and identify all authorized and unauthorized WAPs within the facility(ies).
      annotation: Does the organization test for the presence of Wireless Access Points
        (WAPs) and identify all authorized and unauthorized WAPs within the facility(ies)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-16
      name: Intranets
      description: "Mechanisms exist to establish trust relationships with other organizations\
        \ owning, operating, and/or maintaining intranet systems, allowing authorized\
        \ individuals to: \n(1) Access the intranet from external systems; and\n(2)\
        \ Process, store, and/or transmit organization-controlled information using\
        \ the external systems."
      annotation: "Does the organization establish trust relationships with other\
        \ organizations owning, operating, and/or maintaining intranet systems, allowing\
        \ authorized individuals to: \n (1) Access the intranet from external systems;\
        \ and\n (2) Process, store, and/or transmit organization-controlled information\
        \ using the external systems?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-17
      name: Data Loss Prevention (DLP)
      description: Automated mechanisms exist to implement Data Loss Prevention (DLP)
        to protect sensitive information as it is stored, transmitted and processed.
      annotation: Does the organization use automated mechanisms to implement Data
        Loss Prevention (DLP) to protect sensitive information as it is stored, transmitted
        and processed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18
      name: DNS & Content Filtering
      description: Mechanisms exist to force Internet-bound network traffic through
        a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering
        and DNS filtering to limit a user's ability to connect to dangerous or prohibited
        Internet sites.
      annotation: Does the organization force Internet-bound network traffic through
        a proxy device (e.g., Policy Enforcement Point (PEP)) for URL content filtering
        and DNS filtering to limit a user's ability to connect to dangerous or prohibited
        Internet sites?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.1
      name: Route Internal Traffic to Proxy Servers
      description: Mechanisms exist to route internal communications traffic to external
        networks through organization-approved proxy servers at managed interfaces.
      annotation: Does the organization route internal communications traffic to external
        networks through organization-approved proxy servers at managed interfaces?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.2
      name: Visibility of Encrypted Communications
      description: Mechanisms exist to configure the proxy to make encrypted communications
        traffic visible to monitoring tools and mechanisms.
      annotation: Does the organization configure the proxy to make encrypted communications
        traffic visible to monitoring tools and mechanisms?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.3
      name: Route Privileged Network Access
      description: Automated mechanisms exist to route networked, privileged accesses
        through a dedicated, managed interface for purposes of access control and
        auditing.
      annotation: Does the organization use automated mechanisms to route networked,
        privileged accesses through a dedicated, managed interface for purposes of
        access control and auditing?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.4
      name: Protocol Compliance Enforcement
      description: Automated mechanisms exist to ensure network traffic complies with
        Internet Engineering Task Force (IETF) protocol specifications.
      annotation: Does the organization use automated mechanisms to ensure network
        traffic complies with Internet Engineering Task Force (IETF) protocol specifications?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.5
      name: Domain Name Verification
      description: Mechanisms exist to ensure that domain name lookups, whether for
        internal or external domains, are validated according to Domain Name System
        Security Extensions (DNSSEC).
      annotation: Does the organization ensure that domain name lookups, whether for
        internal or external domains, are validated according to Domain Name System
        Security Extensions (DNSSEC)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.6
      name: Internet Address Denylisting
      description: Mechanisms exist to implement Internet address denylisting protections
        that blocks traffic received from or destined to a denylisted Internet address.
      annotation: Does the organization implement Internet address denylisting protections
        that blocks traffic received from or destined to a denylisted Internet address?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.7
      name: Bandwidth Control
      description: Mechanisms exist to implement bandwidth control technologies to
        limit the amount of bandwidth used by categories of domains that are bandwidth-intensive.
      annotation: Does the organization implement bandwidth control technologies to
        limit the amount of bandwidth used by categories of domains that are bandwidth-intensive?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.8
      name: Authenticated Proxy
      description: Mechanisms exist to force systems and processes to authenticate
        Internet-bound traffic with a proxy to enable user, group and/or location-aware
        security controls.
      annotation: Does the organization force systems and processes to authenticate
        Internet-bound traffic with a proxy to enable user, group and/or location-aware
        security controls?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-18.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-18.9
      name: Certificate Denylisting
      description: Mechanisms exist to prevent communication with systems and/or services
        that use a set of known bad certificates.
      annotation: Does the organization prevent communication with systems and/or
        services that use a set of known bad certificates?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-19
      name: Content Disarm and Reconstruction (CDR)
      description: Automated Content Disarm and Reconstruction (CDR) mechanisms exist
        to detect the presence of unapproved active content and facilitate its removal,
        resulting in content with only known safe elements.
      annotation: Automated Content Disarm and Reconstruction (CDR) mechanisms exist
        to detect the presence of unapproved active content and facilitate its removal,
        resulting in content with only known safe elements?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20
      name: Email Content Protections
      description: Mechanisms exist to implement an email filtering security service
        to detect malicious attachments in emails and prevent users from accessing
        them.
      annotation: Does the organization implement an email filtering security service
        to detect malicious attachments in emails and prevent users from accessing
        them?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.1
      name: Email Domain Reputation Protections
      description: "Mechanisms exist to monitor the organization's email domain\u2019\
        s reputation and protect the email domain\u2019s reputation."
      annotation: "Does the organization monitor its email domain\u2019s reputation\
        \ and protect the email domain\u2019s reputation?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.2
      name: Sender Denylisting
      description: Mechanisms exist to implement sender denylisting protections that
        prevent the reception of email from denylisted senders, domains and/or email
        servers.
      annotation: Does the organization implement sender denylisting protections that
        prevent the reception of email from denylisted senders, domains and/or email
        servers?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.3
      name: Authenticated Received Chain (ARC)
      description: "Mechanisms exist to utilize an authenticated received chain that\
        \ allows for an intermediary to sign its own authentication of the original\
        \ email, allowing downstream entities to accept the intermediary\u2019s authentication\
        \ even if the email was changed."
      annotation: "Does the organization utilize an authenticated received chain that\
        \ allows for an intermediary to sign its own authentication of the original\
        \ email, allowing downstream entities to accept the intermediary\u2019s authentication\
        \ even if the email was changed?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.4
      name: Domain-Based Message Authentication Reporting and Conformance (DMARC)
      description: Mechanisms exist to implement domain signature verification protections
        that authenticate incoming email according to the Domain-based Message Authentication
        Reporting and Conformance (DMARC).
      annotation: Does the organization implement domain signature verification protections
        that authenticate incoming email according to the Domain-based Message Authentication
        Reporting and Conformance (DMARC)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.5
      name: User Digital Signatures for Outgoing Email
      description: "Mechanisms exist to enable users to digitally sign their emails,\
        \ allowing external parties to authenticate the email\u2019s sender and its\
        \ contents according to the Domain-based Message Authentication Reporting\
        \ and Conformance (DMARC) email authentication protocol."
      annotation: "Does the organization enable users to digitally sign their emails,\
        \ allowing external parties to authenticate the email\u2019s sender and its\
        \ contents according to the Domain-based Message Authentication Reporting\
        \ and Conformance (DMARC) email authentication protocol?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.6
      name: Encryption for Outgoing Email
      description: Mechanisms exist to enable the encryption of outgoing emails using
        organization-approved cryptographic means.
      annotation: Does the organization enable the encryption of outgoing emails using
        organization-approved cryptographic means?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.7
      name: Adaptive Email Protections
      description: Mechanisms exist to utilize adaptive email protections that involve
        employing risk-based analysis in the application and enforcement of email
        protections.
      annotation: Does the organization utilize adaptive email protections that involve
        employing risk-based analysis in the application and enforcement of email
        protections?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.8
      name: Email Labeling
      description: Automated mechanisms exist to implement email labeling that apply
        organization-defined tags to incoming or outgoing email.
      annotation: Does the organization use automated mechanisms to implement email
        labeling that apply organization-defined tags to incoming or outgoing email?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:net-20.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:net
      ref_id: NET-20.9
      name: User Threat Reporting
      description: Mechanisms exist to incorporate submissions from users of phishing
        attempts, spam or otherwise malicious actions to better protect the organization.
      annotation: Does the organization incorporate submissions from users of phishing
        attempts, spam or otherwise malicious actions to better protect the organization?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      assessable: false
      depth: 1
      ref_id: PES
      name: Physical & Environmental Security
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-01
      name: Physical & Environmental Protections
      description: Mechanisms exist to facilitate the operation of physical and environmental
        protection controls.
      annotation: Does the organization facilitate the operation of physical and environmental
        protection controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-01.1
      name: Site Security Plan (SitePlan)
      description: Mechanisms exist to document a Site Security Plan (SitePlan) for
        each server and communications room to summarize the implemented security
        controls to protect physical access to technology assets, as well as applicable
        risks and threats.
      annotation: Does the organization document a Site Security Plan (SitePlan) for
        each server and communications room to summarize the implemented security
        controls to protect physical access to technology assets, as well as applicable
        risks and threats?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-01.2
      name: Zone-Based Physical Security
      description: Mechanisms exist to implement a zone-based approach to physical
        security.
      annotation: Does the organization implement a zone-based approach to physical
        security?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-02
      name: Physical Access Authorizations
      description: Physical access control mechanisms exist to maintain a current
        list of personnel with authorized access to organizational facilities (except
        for those areas within the facility officially designated as publicly accessible).
      annotation: Does the organization maintain a current list of personnel with
        authorized access to organizational facilities (except for those areas within
        the facility officially designated as publicly accessible)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-02.1
      name: Role-Based Physical Access
      description: Physical access control mechanisms exist to authorize physical
        access to facilities based on the position or role of the individual.
      annotation: Does the organization authorize physical access to facilities based
        on the position or role of the individual?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-02.2
      name: Dual Authorization for Physical Access
      description: Mechanisms exist to enforce a "two-person rule" for physical access
        by requiring two authorized individuals with separate access cards, keys or
        PINs, to access highly-sensitive areas (e.g., safe, high-security cage, etc.).
      annotation: Does the organization enforce a "two-person rule" for physical access
        by requiring two authorized individuals with separate access cards, keys or
        PINs, to access highly-sensitive areas (e.g., safe, high-security cage, etc.)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-03
      name: Physical Access Control
      description: Physical access control mechanisms exist to enforce physical access
        authorizations for all physical access points (including designated entry/exit
        points) to facilities (excluding those areas within the facility officially
        designated as publicly accessible).
      annotation: Does the organization enforce physical access authorizations for
        all physical access points (including designated entry/exit points) to facilities
        (excluding those areas within the facility officially designated as publicly
        accessible)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-03.1
      name: Controlled Ingress & Egress Points
      description: Physical access control mechanisms exist to limit and monitor physical
        access through controlled ingress and egress points.
      annotation: Does the organization limit and monitor physical access through
        controlled ingress and egress points?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-03.2
      name: Lockable Physical Casings
      description: Physical access control mechanisms exist to protect system components
        from unauthorized physical access (e.g., lockable physical casings).
      annotation: Does the organization protect system components from unauthorized
        physical access (e.g., lockable physical casings)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-03.3
      name: Physical Access Logs
      description: Physical access control mechanisms generate a log entry for each
        access attempt through controlled ingress and egress points.
      annotation: Does the organization generate a log entry for each access attempt
        through controlled ingress and egress points?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-03.4
      name: Access To Information Systems
      description: Physical access control mechanisms exist to enforce physical access
        to critical information systems or sensitive/regulated data, in addition to
        the physical access controls for the facility.
      annotation: Does the organization enforce physical access to critical information
        systems or sensitive/regulated data, in addition to the physical access controls
        for the facility?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-04
      name: Physical Security of Offices, Rooms & Facilities
      description: Mechanisms exist to identify systems, equipment and respective
        operating environments that require limited physical access so that appropriate
        physical access controls are designed and implemented for offices, rooms and
        facilities.
      annotation: Does the organization identify systems, equipment and respective
        operating environments that require limited physical access so that appropriate
        physical access controls are designed and implemented for offices, rooms and
        facilities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-04.1
      name: Working in Secure Areas
      description: Physical security mechanisms exist to allow only authorized personnel
        access to secure areas.
      annotation: Does the organization allow only authorized personnel access to
        secure areas?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-04.2
      name: Searches
      description: Physical access control mechanisms exist to inspect personnel and
        their personal effects (e.g., personal property ordinarily worn or carried
        by the individual, including vehicles) to prevent the unauthorized exfiltration
        of data and technology assets.
      annotation: Does the organization inspect personnel and their personal effects
        (e.g., personal property ordinarily worn or carried by the individual, including
        vehicles) to prevent the unauthorized exfiltration of data and technology
        assets?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-04.3
      name: Temporary Storage
      description: Physical access control mechanisms exist to temporarily store undelivered
        packages or deliveries in a dedicated, secure area (e.g., security cage, secure
        room) that is locked, access-controlled and monitored with surveillance cameras
        and/or security guards.
      annotation: Does the organization temporarily store undelivered packages or
        deliveries in a dedicated, secure area (e.g., security cage, secure room)
        that is locked, access-controlled and monitored with surveillance cameras
        and/or security guards?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-05
      name: Monitoring Physical Access
      description: Physical access control mechanisms exist to monitor for, detect
        and respond to physical security incidents.
      annotation: Does the organization monitor for, detect and respond to physical
        security incidents?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-05.1
      name: Intrusion Alarms / Surveillance Equipment
      description: Physical access control mechanisms exist to monitor physical intrusion
        alarms and surveillance equipment.
      annotation: Does the organization monitor physical intrusion alarms and surveillance
        equipment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-05.2
      name: Monitoring Physical Access To Information Systems
      description: Facility security mechanisms exist to monitor physical access to
        critical information systems or sensitive/regulated data, in addition to the
        physical access monitoring of the facility.
      annotation: Does the organization monitor physical access to critical information
        systems or sensitive/regulated data, in addition to the physical access monitoring
        of the facility?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06
      name: Visitor Control
      description: Physical access control mechanisms exist to identify, authorize
        and monitor visitors before allowing access to the facility (other than areas
        designated as publicly accessible).
      annotation: Does the organization identify, authorize and monitor visitors before
        allowing access to the facility (other than areas designated as publicly accessible)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06.1
      name: Distinguish Visitors from On-Site Personnel
      description: Physical access control mechanisms exist to easily distinguish
        between onsite personnel and visitors, especially in areas where sensitive/regulated
        data is accessible.
      annotation: Does the organization easily distinguish between onsite personnel
        and visitors, especially in areas where sensitive/regulated data is accessible?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06.2
      name: Identification Requirement
      description: Physical access control mechanisms exist to requires at least one(1)
        form of government-issued or organization-issued photo identification to authenticate
        individuals before they can gain access to the facility.
      annotation: Does the organization require at least one (1) form of government-issued
        or organization-issued photo identification to authenticate individuals before
        they can gain access to the facility?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06.3
      name: Restrict Unescorted Access
      description: Physical access control mechanisms exist to restrict unescorted
        access to facilities to personnel with required security clearances, formal
        access authorizations and validate the need for access.
      annotation: Does the organization restrict unescorted access to facilities to
        personnel with required security clearances, formal access authorizations
        and validate the need for access?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06.4
      name: Automated Records Management & Review
      description: Automated mechanisms exist to facilitate the maintenance and review
        of visitor access records.
      annotation: Does the organization use automated mechanisms to facilitate the
        maintenance and review of visitor access records?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06.5
      name: Minimize Visitor Personal Data (PD)
      description: Mechanisms exist to minimize the collection of Personal Data (PD)
        contained in visitor access records.
      annotation: Does the organization minimize the collection of Personal Data (PD)
        contained in visitor access records?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-06.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-06.6
      name: Visitor Access Revocation
      description: Mechanisms exist to ensure visitor badges, or other issued identification,
        are surrendered before visitors leave the facility or are deactivated at a
        pre-determined time/date of expiration.
      annotation: Does the organization ensure visitor badges, or other issued identification,
        are surrendered before visitors leave the facility or are deactivated at a
        pre-determined time/date of expiration?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07
      name: Supporting Utilities
      description: Facility security mechanisms exist to protect power equipment and
        power cabling for the system from damage and destruction.
      annotation: Does the organization protect power equipment and power cabling
        for the system from damage and destruction?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.1
      name: Automatic Voltage Controls
      description: Facility security mechanisms exist to utilize automatic voltage
        controls for critical system components.
      annotation: Does the organization utilize automatic voltage controls for critical
        system components?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.2
      name: Emergency Shutoff
      description: 'Facility security mechanisms exist to shut off power in emergency
        situations by:

        (1) Placing emergency shutoff switches or devices in close proximity to systems
        or system components to facilitate safe and easy access for personnel; and

        (2) Protecting emergency power shutoff capability from unauthorized activation.'
      annotation: "Does the organization shut off power in emergency situations by:\n\
        \ (1) Placing emergency shutoff switches or devices in close proximity to\
        \ systems or system components to facilitate safe and easy access for personnel;\
        \ and\n (2) Protecting emergency power shutoff capability from unauthorized\
        \ activation?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.3
      name: Emergency Power
      description: Facility security mechanisms exist to supply alternate power, capable
        of maintaining minimally-required operational capability, in the event of
        an extended loss of the primary power source.
      annotation: Does the organization supply alternate power, capable of maintaining
        minimally-required operational capability, in the event of an extended loss
        of the primary power source?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.4
      name: Emergency Lighting
      description: Facility security mechanisms exist to utilize and maintain automatic
        emergency lighting that activates in the event of a power outage or disruption
        and that covers emergency exits and evacuation routes within the facility.
      annotation: Does the organization utilize and maintain automatic emergency lighting
        that activates in the event of a power outage or disruption and that covers
        emergency exits and evacuation routes within the facility?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.5
      name: Water Damage Protection
      description: Facility security mechanisms exist to protect systems from damage
        resulting from water leakage by providing master shutoff valves that are accessible,
        working properly and known to key personnel.
      annotation: Does the organization protect systems from damage resulting from
        water leakage by providing master shutoff valves that are accessible, working
        properly and known to key personnel?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.6
      name: Automation Support for Water Damage Protection
      description: Facility security mechanisms exist to detect the presence of water
        in the vicinity of critical information systems and alert facility maintenance
        and IT personnel.
      annotation: Does the organization detect the presence of water in the vicinity
        of critical information systems and alert facility maintenance and IT personnel?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-07.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-07.7
      name: Redundant Cabling
      description: Mechanisms exist to employ redundant power cabling paths that are
        physically separated to ensure that power continues to flow in the event one
        of the cables is cut or otherwise damaged.
      annotation: Does the organization employ redundant power cabling paths that
        are physically separated to ensure that power continues to flow in the event
        one of the cables is cut or otherwise damaged?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-08
      name: Fire Protection
      description: Facility security mechanisms exist to utilize and maintain fire
        suppression and detection devices/systems for the system that are supported
        by an independent energy source.
      annotation: Does the organization utilize and maintain fire suppression and
        detection devices/systems for the system that are supported by an independent
        energy source?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-08.1
      name: Fire Detection Devices
      description: Facility security mechanisms exist to utilize and maintain fire
        detection devices/systems that activate automatically and notify organizational
        personnel and emergency responders in the event of a fire.
      annotation: Does the organization utilize and maintain fire detection devices/systems
        that activate automatically and notify organizational personnel and emergency
        responders in the event of a fire?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-08.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-08.2
      name: Fire Suppression Devices
      description: Facility security mechanisms exist to utilize fire suppression
        devices/systems that provide automatic notification of any activation to organizational
        personnel and emergency responders.
      annotation: Does the organization utilize fire suppression devices/systems that
        provide automatic notification of any activation to organizational personnel
        and emergency responders?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-08.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-08.3
      name: Automatic Fire Suppression
      description: Facility security mechanisms exist to employ an automatic fire
        suppression capability for critical information systems when the facility
        is not staffed on a continuous basis.
      annotation: Does the organization employ an automatic fire suppression capability
        for critical information systems when the facility is not staffed on a continuous
        basis?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-09
      name: Temperature & Humidity Controls
      description: Facility security mechanisms exist to maintain and monitor temperature
        and humidity levels within the facility.
      annotation: Does the organization maintain and monitor temperature and humidity
        levels within the facility?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-09.1
      name: Monitoring with Alarms / Notifications
      description: Facility security mechanisms exist to trigger an alarm or notification
        of temperature and humidity changes that be potentially harmful to personnel
        or equipment.
      annotation: Does the organization trigger an alarm or notification of temperature
        and humidity changes that be potentially harmful to personnel or equipment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-10
      name: Delivery & Removal
      description: Physical security mechanisms exist to isolate information processing
        facilities from points such as delivery and loading areas and other points
        to avoid unauthorized access.
      annotation: Does the organization isolate information processing facilities
        from points such as delivery and loading areas and other points to avoid unauthorized
        access?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-11
      name: Alternate Work Site
      description: Physical security mechanisms exist to utilize appropriate management,
        operational and technical controls at alternate work sites.
      annotation: Does the organization utilize appropriate management, operational
        and technical controls at alternate work sites?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-12
      name: Equipment Siting & Protection
      description: Physical security mechanisms exist to locate system components
        within the facility to minimize potential damage from physical and environmental
        hazards and to minimize the opportunity for unauthorized access.
      annotation: Does the organization locate system components within the facility
        to minimize potential damage from physical and environmental hazards and to
        minimize the opportunity for unauthorized access?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-12.1
      name: Transmission Medium Security
      description: Physical security mechanisms exist to protect power and telecommunications
        cabling carrying data or supporting information services from interception,
        interference or damage.
      annotation: Does the organization protect power and telecommunications cabling
        carrying data or supporting information services from interception, interference
        or damage?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-12.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-12.2
      name: Access Control for Output Devices
      description: Physical security mechanisms exist to restrict access to printers
        and other system output devices to prevent unauthorized individuals from obtaining
        the output.
      annotation: Does the organization restrict access to printers and other system
        output devices to prevent unauthorized individuals from obtaining the output?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-13
      name: Information Leakage Due To Electromagnetic Signals Emanations
      description: Facility security mechanisms exist to protect the system from information
        leakage due to electromagnetic signals emanations.
      annotation: Does the organization protect the system from information leakage
        due to electromagnetic signals emanations?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-14
      name: Asset Monitoring and Tracking
      description: Physical security mechanisms exist to employ asset location technologies
        that track and monitor the location and movement of organization-defined assets
        within organization-defined controlled areas.
      annotation: Does the organization employ asset location technologies that track
        and monitor the location and movement of organization-defined assets within
        organization-defined controlled areas?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-15
      name: Electromagnetic Pulse (EMP) Protection
      description: Physical security mechanisms exist to employ safeguards against
        Electromagnetic Pulse (EMP) damage for systems and system components.
      annotation: Does the organization employ safeguards against Electromagnetic
        Pulse (EMP) damage for systems and system components?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-16
      name: Component Marking
      description: Physical security mechanisms exist to mark system hardware components
        indicating the impact or classification level of the information permitted
        to be processed, stored or transmitted by the hardware component.
      annotation: Does the organization mark system hardware components indicating
        the impact or classification level of the information permitted to be processed,
        stored or transmitted by the hardware component?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-17
      name: Proximity Sensor
      description: Automated mechanisms exist to monitor physical proximity to robotic
        or autonomous platforms to reduce applied force or stop the operation when
        sensors indicate a potentially dangerous scenario.
      annotation: Does the organization use automated mechanisms to monitor physical
        proximity to robotic or autonomous platforms to reduce applied force or stop
        the operation when sensors indicate a potentially dangerous scenario?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-18
      name: On-Site Client Segregation
      description: Mechanisms exist to ensure client-specific Intellectual Property
        (IP) is isolated from other data when client-specific IP is processed or stored
        within multi-client workspaces.
      annotation: Does the organization ensure client-specific Intellectual Property
        (IP) is isolated from other data when client-specific IP is processed or stored
        within multi-client workspaces?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pes
      ref_id: PES-19
      name: Physical Access Device Inventories
      description: Mechanisms exist to maintain an accurate inventory of all physical
        access devices (e.g., RFID cards, access fobs, door keys, etc.).
      annotation: Does the organization maintain an accurate inventory of all physical
        access devices (e.g., RFID cards, access fobs, door keys, etc.)?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      assessable: false
      depth: 1
      ref_id: PRI
      name: Data Privacy
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01
      name: Data Privacy Program
      description: Mechanisms exist to facilitate the implementation and operation
        of data protection controls throughout the data lifecycle to ensure all forms
        of Personal Data (PD) are processed lawfully, fairly and transparently.
      annotation: Does the organization facilitate the implementation and operation
        of data protection controls throughout the data lifecycle to ensure all forms
        of Personal Data (PD) are processed lawfully, fairly and transparently?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.1
      name: Chief Privacy Officer (CPO)
      description: Mechanisms exist to appoints a Chief Privacy Officer (CPO) or similar
        role, with the authority, mission, accountability and resources to coordinate,
        develop and implement, applicable data privacy requirements and manage data
        privacy risks through the organization-wide data privacy program.
      annotation: Does the organization have a Chief Privacy Officer (CPO) or similar
        role, with the authority, mission, accountability and resources to coordinate,
        develop and implement, applicable data privacy requirements and manage data
        privacy risks through the organization-wide data privacy program?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.2
      name: Privacy Act Statements
      description: "Mechanisms exist to provide additional formal notice to individuals\
        \ from whom the information is being collected that includes:\n(1) Notice\
        \ of the authority of organizations to collect Personal Data (PD); \n(2) Whether\
        \ providing PD is mandatory or optional; \n(3) The principal purpose or purposes\
        \ for which the PD is to be used; \n(4) The intended disclosures or routine\
        \ uses of the information; and \n(5) The consequences of not providing all\
        \ or some portion of the information requested."
      annotation: "Does the organization provide additional formal notice to individuals\
        \ from whom the information is being collected that includes:\n (1) Notice\
        \ of the authority of organizations to collect Personal Data (PD); \n (2)\
        \ Whether providing PD is mandatory or optional; \n (3) The principal purpose\
        \ or purposes for which the PD is to be used; \n (4) The intended disclosures\
        \ or routine uses of the information; and \n (5) The consequences of not providing\
        \ all or some portion of the information requested?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.3
      name: Dissemination of Data Privacy Program Information
      description: "Mechanisms exist to: \n(1) Ensure that the public has access to\
        \ information about organizational data privacy activities and can communicate\
        \ with its Chief Privacy Officer (CPO) or similar role;\n(2) Ensure that organizational\
        \ data privacy practices are publicly available through organizational websites\
        \ or document repositories; \n(3) Utilize publicly facing email addresses\
        \ and/or phone lines to enable the public to provide feedback and/or direct\
        \ questions to data privacy office(s) regarding data privacy practices; and\n\
        (4) Inform data subjects when changes are made to the privacy notice and the\
        \ nature of such changes."
      annotation: "Does the organization: \n (1) Ensure that the public has access\
        \ to information about organizational data privacy activities and can communicate\
        \ with its Chief Privacy Officer (CPO) or similar role;\n (2) Ensure that\
        \ organizational data privacy practices are publicly available through organizational\
        \ websites or document repositories; \n (3) Utilize publicly facing email\
        \ addresses and/or phone lines to enable the public to provide feedback and/or\
        \ direct questions to data privacy office(s) regarding data privacy practices;\
        \ and\n (4) Inform data subjects when changes are made to the privacy notice\
        \ and the nature of such changes?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.4
      name: Data Protection Officer (DPO)
      description: 'Mechanisms exist to appoint a Data Protection Officer (DPO):

        (1) Based on professional qualifications; and

        (2) To be involved in all issues related to how Personal Data (PD) is collected,
        received, processed, stored, transmitted and disposed.'
      annotation: "Does the organization appoint a Data Protection Officer (DPO):\n\
        \ (1) Based on professional qualifications; and\n (2) To be involved in all\
        \ issues related to how Personal Data (PD) is collected, received, processed,\
        \ stored, transmitted and disposed?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.5
      name: Binding Corporate Rules (BCR)
      description: Mechanisms exist to implement and manage Binding Corporate Rules
        (BCR) (e.g., data sharing agreement) to legally-bind all parties engaged in
        a joint economic activity that contractually states enforceable rights on
        data subjects with regard to the processing of their personal data.
      annotation: Does the organization implement and manage Binding Corporate Rules
        (BCR) (e.g., data sharing agreement) to legally-bind all parties engaged in
        a joint economic activity that contractually states enforceable rights on
        data subjects with regard to the processing of their personal data?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.6
      name: Security of Personal Data (PD)
      description: Mechanisms exist to ensure Personal Data (PD) is protected by logical
        and physical security safeguards that are sufficient and appropriately scoped
        to protect the confidentiality and integrity of the PD.
      annotation: Does the organization ensure Personal Data (PD) is protected by
        logical and physical security safeguards that are sufficient and appropriately
        scoped to protect the confidentiality and integrity of the PD?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.7
      name: Limiting Personal Data (PD) Disclosures
      description: Mechanisms exist to limit the disclosure of Personal Data (PD)
        to authorized parties for the sole purpose for which the PD was obtained.
      annotation: Does the organization limit the disclosure of Personal Data (PD)
        to authorized parties for the sole purpose for which the PD was obtained?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.8
      name: Data Fiduciary
      description: "Mechanisms exist to appoint an individual to determine the following\
        \ criteria about Personal Data (PD):\n(1) The purpose why PD is necessary;\
        \ \n(2) Authorized methods to collect, receive, process, store, transmit and\
        \ dispose PD; and\n(3) Authorized parties PD may be shared with."
      annotation: "Does the organization appoint an individual to determine the following\
        \ criteria about Personal Data (PD):\n(1) The purpose why PD is necessary;\
        \ \n(2) Authorized methods to collect, receive, process, store, transmit and\
        \ dispose PD; and\n(3) Authorized parties PD may be shared with?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.9
      name: Personal Data (PD) Process Manager
      description: Mechanisms exist to assign accountability to a Personal Data Process
        Manager, or equivalent role, to ensure Personal Data (PD) is collected, processed,
        stored, shared, protected and disposed of according to data subject consent.
      annotation: Does the organization assign accountability to a Personal Data Process
        Manager, or equivalent role, to ensure Personal Data (PD) is collected, processed,
        stored, shared, protected and disposed of according to data subject consent?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-01.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-01.10
      name: Financial Incentives For Personal Data (PD)
      description: Mechanisms exist to strictly govern financial incentives offered
        to data subjects for Personal Data (PD) to ensure compliance with applicable
        legal and regulatory requirements.
      annotation: Does the organization strictly govern financial incentives offered
        to data subjects for Personal Data (PD) to ensure compliance with applicable
        legal and regulatory requirements?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02
      name: Data Privacy Notice
      description: "Mechanisms exist to:\n(1) Make data privacy notice(s) available\
        \ to individuals upon first interacting with an organization and subsequently\
        \ as necessary; \n(2) Ensure that data privacy notices are clear and easy-to-understand,\
        \ expressing relevant information about how Personal Data (PD) is collected,\
        \ received, processed, stored, transmitted, shared, updated and disposed;\n\
        (3) Contain all necessary notice-related criteria required by applicable statutory,\
        \ regulatory and contractual obligations.\n(4) Define the scope of PD processing\
        \ activities, including the geographic locations and third-party recipients\
        \ that process the PD within the scope of the data privacy notice;\n(5) Periodically,\
        \ review and update the content of the privacy notice, as necessary; and\n\
        (6) Retain prior versions of the privacy notice, in accordance with data retention\
        \ requirements."
      annotation: "Does the organization:\n (1) Make data privacy notice(s) available\
        \ to individuals upon first interacting with an organization and subsequently\
        \ as necessary; \n (2) Ensure that data privacy notices are clear and easy-to-understand,\
        \ expressing relevant information about how Personal Data (PD) is collected,\
        \ received, processed, stored, transmitted, shared, updated and disposed;\n\
        \ (3) Contain all necessary notice-related criteria required by applicable\
        \ statutory, regulatory and contractual obligations.\n (4) Define the scope\
        \ of PD processing activities, including the geographic locations and third-party\
        \ recipients that process the PD within the scope of the data privacy notice;\n\
        \ (5) Periodically, review and update the content of the privacy notice, as\
        \ necessary; and\n (6) Retain prior versions of the privacy notice, in accordance\
        \ with data retention requirements?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.1
      name: Purpose Specification
      description: Mechanisms exist to ensure the data privacy notice identifies the
        purpose(s) for which Personal Data (PD) is collected, received, processed,
        stored, transmitted, shared.
      annotation: Does the organization ensure the data privacy notice identifies
        the purpose(s) for which Personal Data (PD) is collected, received, processed,
        stored, transmitted, shared?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.2
      name: Automated Data Management Processes
      description: Automated mechanisms exist to adjust data that is able to be collected,
        received, processed, stored, transmitted, shared, based on updated data subject
        authorization(s).
      annotation: Does the organization use automated mechanisms to adjust data that
        is able to be collected, received, processed, stored, transmitted, shared,
        based on updated data subject authorization(s)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.3
      name: Computer Matching Agreements (CMA)
      description: Mechanisms exist to publish Computer Matching Agreements (CMA)
        on the organization's public website(s).
      annotation: Does the organization publish Computer Matching Agreements (CMA)
        on its public website(s)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.4
      name: System of Records Notice (SORN)
      description: Mechanisms exist to draft, publish and keep System of Records Notices
        (SORN) updated in accordance with regulatory guidance.
      annotation: Does the organization draft, publish and keep System of Records
        Notices (SORN) updated in accordance with regulatory guidance?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.5
      name: System of Records Notice (SORN) Review Process
      description: Mechanisms exist to review all routine uses of data published in
        the System of Records Notices (SORN) to ensure continued accuracy and to ensure
        that routine uses continue to be compatible with the purpose for which the
        information was collected.
      annotation: Does the organization review all routine uses of data published
        in the System of Records Notices (SORN) to ensure continued accuracy and to
        ensure that routine uses continue to be compatible with the purpose for which
        the information was collected?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.6
      name: Privacy Act Exemptions
      description: Mechanisms exist to review all Privacy Act exemptions claimed for
        the System of Records Notices (SORN) to ensure they remain appropriate and
        accurate.
      annotation: Does the organization review all Privacy Act exemptions claimed
        for the System of Records Notices (SORN) to ensure they remain appropriate
        and accurate?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-02.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-02.7
      name: Real-Time or Layered Notice
      description: Mechanisms exist to provide real-time and/or layered notice when
        Personal Data (PD) is collected that provides data subjects with a summary
        of key points or more detailed information that is specific to the organization's
        data privacy notice.
      annotation: Does the organization provide real-time and/or layered notice when
        Personal Data (PD) is collected that provides data subjects with a summary
        of key points or more detailed information that is specific to its data privacy
        notice?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03
      name: Choice & Consent
      description: "Mechanisms exist to enable data subjects to authorize the collection,\
        \ processing, storage, sharing, updating and disposal of their Personal Data\
        \ (PD), where prior to collection the data subject is provided with:\n(1)\
        \ Plain language to illustrate the potential data privacy risks of the authorization;\
        \ \n(2) A means for users to decline the authorization; and\n(3) All necessary\
        \ choice and consent-related criteria required by applicable statutory, regulatory\
        \ and contractual obligations."
      annotation: "Does the organization authorize the collection, processing, storage,\
        \ sharing, updating and disposal of a data subject's Personal Data (PD), where\
        \ prior to collection the data subject is provided with:\n (1) Plain language\
        \ to illustrate the potential data privacy risks of the authorization; \n\
        \ (2) A means for users to decline the authorization; and\n (3) All necessary\
        \ choice and consent-related criteria required by applicable statutory, regulatory\
        \ and contractual obligations?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.1
      name: Tailored Consent
      description: Mechanisms exist to allow data subjects to modify permission to
        collect, receive, process, store, transmit, update and/or share selected attributes
        of their Personal Data (PD).
      annotation: Does the organization allow data subjects to modify permission to
        collect, receive, process, store, transmit, update and/or share selected attributes
        of their Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.2
      name: Just-In-Time Notice & Updated Consent
      description: 'Mechanisms exist to present data subjects with a new or updated
        consent request to process, store and/or share Personal Data (PD) in conjunction
        with the data action, when:

        (1) The original circumstances under which an individual gave consent have
        changed; or

        (2) A significant amount of time has passed since an individual gave consent.'
      annotation: "Does the organization present data subjects with a new or updated\
        \ consent request to process, store and/or share Personal Data (PD) in conjunction\
        \ with the data action, when:\n (1) The original circumstances under which\
        \ an individual gave consent have changed; or\n (2) A significant amount of\
        \ time has passed since an individual gave consent/"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.3
      name: Prohibition of Selling, Processing and/or Sharing Personal Data (PD)
      description: 'Mechanisms exist to prevent the sale, processing and/or sharing
        of Personal Data (PD) when:

        (1) Instructed by the data subject; or

        (2) The data subject is a minor, where selling and/or sharing PD is legally
        prohibited.'
      annotation: "Does the organization prevent the sale, processing and/or sharing\
        \ of Personal Data (PD) when:\n (1) Instructed by the data subject; or\n (2)\
        \ The data subject is a minor, where selling and/or sharing PD is legally\
        \ prohibited?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.4
      name: Revoke Consent
      description: Mechanisms exist to allow data subjects to revoke consent to collect,
        receive, process, store, transmit, update and/or share their Personal Data
        (PD).
      annotation: Does the organization allow data subjects to revoke consent to collect,
        receive, process, store, transmit, update and/or share their Personal Data
        (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.5
      name: Product or Service Delivery Restrictions
      description: 'Mechanisms exist to prevent discrimination against a data subject
        for exercising their legal rights pertaining to modifying or revoking consent,
        including prohibiting:

        (1) Refusing products and/or services;

        (2) Charging different rates for goods and/or services; and

        (3) Providing different levels of quality.'
      annotation: "Does the organization prevent discrimination against a data subject\
        \ for exercising their legal rights pertaining to modifying or revoking consent,\
        \ including prohibiting:\n (1) Refusing products and/or services;\n (2) Charging\
        \ different rates for goods and/or services; and\n (3) Providing different\
        \ levels of quality?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.6
      name: Authorized Agent
      description: Mechanisms exist to allow data subjects to authorize another person
        or entity, acting on the data subject's behalf, to make Personal Data (PD)
        processing decisions.
      annotation: Does the organization allow data subjects to authorize another person
        or entity, acting on the data subject's behalf, to make Personal Data (PD)
        processing decisions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.7
      name: Active Participation By Data Subjects
      description: Mechanisms exist to compel data subjects to select the level of
        consent deemed appropriate by the data subject for the relevant business purpose
        (e.g., opt-in, opt-out, accept all cookies, etc.).
      annotation: Does the organization compel data subjects to select the level of
        consent deemed appropriate by the data subject for the relevant business purpose
        (e.g., opt-in, opt-out, accept all cookies, etc.)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.8
      name: Global Privacy Control (GPC)
      description: Automated mechanisms exist to provide data subjects with functionality
        to exercise pre-selected opt-out preferences (e.g., opt-out signal).
      annotation: Does the organization use automated mechanisms to provide data subjects
        with functionality to exercise pre-selected opt-out preferences (e.g., opt-out
        signal)?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.9
      name: Continued Use of Personal Data (PD)
      description: 'Mechanisms exist to govern the continued use of Personal Data
        (PD) as it is collected, received, processed, stored, transmitted and/or shared
        until:

        (1) Disposal of PD occurs when there is no longer a legitimate business purpose;

        (2) Disposal of PD occurs when the data retention timeline for the use case
        is met; and/or

        (3) Continued use of PD is prohibited upon withdrawal of data subject consent.'
      annotation: "Does the organization govern the continued use of Personal Data\
        \ (PD) as it is collected, received, processed, stored, transmitted and/or\
        \ shared until:\n (1) Disposal of PD occurs when there is no longer a legitimate\
        \ business purpose;\n (2) Disposal of PD occurs when the data retention timeline\
        \ for the use case is met; and/or\n (3) Continued use of PD is prohibited\
        \ upon withdrawal of data subject consent?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.10
      name: Cease Processing, Storing and/or Sharing Personal Data (PD)
      description: Mechanisms exist to ensure the organization ceases collecting,
        receiving, processing, storing, transmitting, updating and/or sharing Personal
        Data (PD) upon receiving a data subject's consent revocation.
      annotation: Does the organization ensure it ceases collecting, receiving, processing,
        storing, transmitting, updating and/or sharing Personal Data (PD) upon receiving
        a data subject's consent revocation?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-03.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-03.11
      name: Communicating Processing Changes
      description: 'Mechanisms exist to notify data subjects of processing changes
        affecting their Personal Data (PD), including:

        (1) Erasure of PD;

        (2) Remediation of incorrect PD; and/or

        (3) Processing restrictions affecting their PD.'
      annotation: "Does the organization notify data subjects of processing changes\
        \ affecting their Personal Data (PD), including:\n (1) Erasure of PD;\n (2)\
        \ Remediation of incorrect PD; and/or\n (3) Processing restrictions affecting\
        \ their PD?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04
      name: Restrict Collection To Identified Purpose
      description: Mechanisms exist to minimize the collection of Personal Data (PD)
        to only what is adequate, relevant and limited to the purposes identified
        in the data privacy notice, including protections against collecting PD from
        minors without appropriate parental or legal guardian consent.
      annotation: Does the organization minimize the collection of Personal Data (PD)
        to only what is adequate, relevant and limited to the purposes identified
        in the data privacy notice, including protections against collecting PD from
        minors without appropriate parental or legal guardian consent?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.1
      name: Authority To Collect, Process, Store & Share Personal Data (PD)
      description: Mechanisms exist to determine and document the legal authority
        that permits the organization to collect, receive, process, store, transmit,
        update and/or share Personal Data (PD), either generally or in support of
        a specific business process.
      annotation: Does the organization determine and document the legal authority
        that permits the organization to collect, receive, process, store, transmit,
        update and/or share Personal Data (PD), either generally or in support of
        a specific business process?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.2
      name: Primary Sources
      description: Mechanisms exist to ensure information is directly collected from
        the data subject, whenever possible.
      annotation: Does the organization ensure information is directly collected from
        the data subject, whenever possible?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.3
      name: Identifiable Image Collection
      description: Mechanisms exist to restrict collecting, receiving, processing,
        storing, transmitting and/or sharing of photographic and/or video surveillance
        image collection that can identify individuals to legitimate business needs.
      annotation: Does the organization restrict collecting, receiving, processing,
        storing, transmitting and/or sharing of photographic and/or video surveillance
        image collection that can identify individuals to legitimate business needs?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.4
      name: Acquired Personal Data (PD)
      description: Mechanisms exist to promptly inform data subjects of the utilization
        purpose when their Personal Data (PD) is acquired and not received directly
        from the data subject, except where that utilization purpose was disclosed
        in advance to the data subject.
      annotation: Does the organization promptly inform data subjects of the utilization
        purpose when their Personal Data (PD) is acquired and not received directly
        from the data subject, except where that utilization purpose was disclosed
        in advance to the data subject?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.5
      name: Validate Collected Personal Data (PD)
      description: Mechanisms exist to ensure that the data subject, or authorized
        representative, validate Personal Data (PD) during the collection process.
      annotation: Does the organization ensure that the data subject, or authorized
        representative, validate Personal Data (PD) during the collection process?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.6
      name: Re-Validate Collected Personal Data (PD)
      description: Mechanisms exist to ensure that the data subject, or authorized
        representative, re-validate that Personal Data (PD) acquired during the collection
        process is still accurate.
      annotation: Does the organization ensure that the data subject, or authorized
        representative, re-validate that Personal Data (PD) acquired during the collection
        process is still accurate?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-04.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-04.7
      name: Personal Data (PD) Collection Methods
      description: 'Mechanisms exist to ensure that Personal Data (PD) collection
        methods are:

        (1) In accordance with applicable statutory and/or regulatory requirements;

        (2) Appropriate for the circumstances of the data subject;

        (3) Unambiguous; and

        (4) Secure.'
      annotation: "Does the organization ensure that Personal Data (PD) collection\
        \ methods are:\n (1) In accordance with applicable statutory and/or regulatory\
        \ requirements;\n (2) Appropriate for the circumstances of the data subject;\n\
        \ (3) Unambiguous; and\n (4) Secure?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05
      name: Personal Data (PD) Retention & Disposal
      description: "Mechanisms exist to: \n(1) Retain Personal Data (PD), including\
        \ metadata, for an organization-defined time period to fulfill the purpose(s)\
        \ identified in the notice or as required by law;\n(2) Dispose of, destroys,\
        \ erases, and/or anonymizes the PD, regardless of the method of storage; and\n\
        (3) Use organization-defined techniques or methods to ensure secure deletion\
        \ or destruction of PD (including originals, copies and archived records)."
      annotation: "Does the organization: \n (1) Retain Personal Data (PD), including\
        \ metadata, for an organization-defined time period to fulfill the purpose(s)\
        \ identified in the notice or as required by law;\n (2) Dispose of, destroys,\
        \ erases, and/or anonymizes the PD, regardless of the method of storage; and\n\
        \ (3) Use organization-defined techniques or methods to ensure secure deletion\
        \ or destruction of PD (including originals, copies and archived records)?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.1
      name: Internal Use of Personal Data (PD) For Testing, Training and Research
      description: 'Mechanisms exist to address the use of Personal Data (PD) for
        internal testing, training and research that:

        (1) Takes measures to limit or minimize the amount of PD used for internal
        testing, training and research purposes; and

        (2) Authorizes the use of PD when such information is required for internal
        testing, training and research.'
      annotation: "Does the organization address the use of Personal Data (PD) for\
        \ internal testing, training and research that:\n (1) Takes measures to limit\
        \ or minimize the amount of PD used for internal testing, training and research\
        \ purposes; and\n (2) Authorizes the use of PD when such information is required\
        \ for internal testing, training and research?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.2
      name: Personal Data (PD) Accuracy & Integrity
      description: "Mechanisms exist to ensure the accuracy and relevance of Personal\
        \ Data (PD) throughout the information lifecycle by:\n(1) Keeping PD up-to-date;\
        \ and \n(2) Remediating identified inaccuracies, as necessary."
      annotation: "Does the organization ensure the accuracy and relevance of Personal\
        \ Data (PD) throughout the information lifecycle by:\n (1) Keeping PD up-to-date;\
        \ and \n (2) Remediating identified inaccuracies, as necessary?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.3
      name: Data Masking
      description: Mechanisms exist to mask sensitive/regulated data through data
        anonymization, pseudonymization, redaction or de-identification.
      annotation: Does the organization mask sensitive/regulated data through data
        anonymization, pseudonymization, redaction or de-identification?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.4
      name: Usage Restrictions of Personal Data (PD)
      description: 'Mechanisms exist to restrict collecting, receiving, processing,
        storing, transmitting, updating and/or sharing Personal Data (PD) to:

        (1) The purpose(s) originally collected, consistent with the data privacy
        notice(s);

        (2) What is authorized by the data subject, or authorized agent; and

        (3) What is consistent with applicable laws, regulations and contractual obligations.'
      annotation: "Does the organization restrict collecting, receiving, processing,\
        \ storing, transmitting, updating and/or sharing Personal Data (PD) to:\n\
        \ (1) The purpose(s) originally collected, consistent with the data privacy\
        \ notice(s);\n (2) What is authorized by the data subject, or authorized agent;\
        \ and\n (3) What is consistent with applicable laws, regulations and contractual\
        \ obligations?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.5
      name: Inventory of Personal Data (PD)
      description: Mechanisms exist to establish and maintain a current inventory
        of all systems, applications and services that collect, receive, process,
        store, transmit, update and/or share Personal Data (PD).
      annotation: Does the organization establish and maintain a current inventory
        of all systems, applications and services that collect, receive, process,
        store, transmit, update and/or share Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.6
      name: Personal Data (PD) Inventory Automation Support
      description: Automated mechanisms exist to determine if Personal Data (PD) is
        maintained in electronic form.
      annotation: Does the organization use automated mechanisms to determine if Personal
        Data (PD) is maintained in electronic form?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.7
      name: Personal Data (PD) Categories
      description: Mechanisms exist to define and implement data handling and protection
        requirements for specific categories of sensitive Personal Data (PD).
      annotation: Does the organization define and implement data handling and protection
        requirements for specific categories of sensitive Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-05.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-05.8
      name: Personal Data (PD) Formats
      description: Mechanisms exist to retain Personal Data (PD) in a format permitting
        data subject identification for no longer than is necessary for legitimate
        business purposes.
      annotation: Does the organization retain Personal Data (PD) in a format permitting
        data subject identification for no longer than is necessary for legitimate
        business purposes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06
      name: Data Subject Empowerment
      description: "Mechanisms exist to provide authenticated data subjects the ability\
        \ to:\n(1) Access their Personal Data (PD) that is being processed, stored\
        \ and shared, except where the burden, risk or expense of providing access\
        \ would be disproportionate to the benefit offered to the data subject through\
        \ granting access;\n(2) Obtain answers on the specifics of how their PD is\
        \ collected, received, processed, stored, transmitted, shared, updated and\
        \ disposed; \n(3) Obtain the source(s) of their PD; \n(4) Obtain the categories\
        \ of their PD being collected, received, processed, stored and shared; \n\
        (5) Request correction to their PD due to inaccuracies;\n(6) Request erasure\
        \ of their PD; and\n(7) Restrict the further collecting, receiving, processing,\
        \ storing, transmitting, updated and/or sharing of their PD."
      annotation: "Does the organization provide authenticated data subjects the ability\
        \ to:\n (1) Access their Personal Data (PD) that is being processed, stored\
        \ and shared, except where the burden, risk or expense of providing access\
        \ would be disproportionate to the benefit offered to the data subject through\
        \ granting access;\n (2) Obtain answers on the specifics of how their PD is\
        \ collected, received, processed, stored, transmitted, shared, updated and\
        \ disposed; \n (3) Obtain the source(s) of their PD; \n (4) Obtain the categories\
        \ of their PD being collected, received, processed, stored and shared; \n\
        \ (5) Request correction to their PD due to inaccuracies;\n (6) Request erasure\
        \ of their PD; and\n (7) Restrict the further collecting, receiving, processing,\
        \ storing, transmitting, updated and/or sharing of their PD?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.1
      name: Correcting Inaccurate Personal Data (PD)
      description: 'Mechanisms exist to maintain a process for:

        (1) Data subjects to have inaccurate Personal Data (PD) maintained by the
        organization corrected or amended; and

        (2) Disseminating corrections or amendments of PD to other authorized users
        of the PD.'
      annotation: "Does the organization maintain a process for:\n (1) Data subjects\
        \ to have inaccurate Personal Data (PD) maintained by the organization corrected\
        \ or amended; and\n (2) Disseminating corrections or amendments of PD to other\
        \ authorized users of the PD?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.2
      name: Notice of Correction or Processing Change
      description: Mechanisms exist to notify affected data subjects if their Personal
        Data (PD) has been corrected or amended.
      annotation: Does the organization notify affected data subjects if their Personal
        Data (PD) has been corrected or amended?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.3
      name: Appeal Adverse Decision
      description: Mechanisms exist to maintain a process for data subjects to appeal
        an adverse decision.
      annotation: Does the organization maintain a process for data subjects to appeal
        an adverse decision?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.4
      name: User Feedback Management
      description: Mechanisms exist to maintain a process to efficiently and effectively
        respond to complaints, concerns or questions from authenticated data subjects
        about how the organization collects, receives, processes, stores, transmits,
        shares, updates and/or disposes of their Personal Data (PD).
      annotation: Does the organization maintain a process to efficiently and effectively
        respond to complaints, concerns or questions from authenticated data subjects
        about how it collects, receives, processes, stores, transmits, shares, updates
        and/or disposes of their Personal Data (PD)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.5
      name: Right to Erasure
      description: Mechanisms exist to maintain a process to erase a data subject's
        Personal Data (PD), in accordance with applicable laws, regulations and contractual
        obligations pertaining to the retention of their PD.
      annotation: Does the organization maintain a process to erase a data subject's
        Personal Data (PD), in accordance with applicable laws, regulations and contractual
        obligations pertaining to the retention of their PD?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.6
      name: Data Portability
      description: Mechanisms exist to format exports of Personal Data (PD) in a structured,
        machine-readable format that allows data subjects to transfer their PD to
        another controller without hindrance.
      annotation: Does the organization format exports of Personal Data (PD) in a
        structured, machine-readable format that allows data subjects to transfer
        their PD to another controller without hindrance?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-06.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-06.7
      name: Personal Data (PD) Exports
      description: Mechanisms exist to export a data subject's available Personal
        Data (PD) in a readily usable format, upon an authenticated request.
      annotation: Does the organization process an export of a data subject's available
        Personal Data (PD) in a readily usable format, upon an authenticated request?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-07
      name: Information Sharing With Third Parties
      description: Mechanisms exist to disclose Personal Data (PD) to third-parties
        only for the purposes identified in the data privacy notice and with the implicit
        or explicit consent of the data subject.
      annotation: Does the organization disclose Personal Data (PD) to third-parties
        only for the purposes identified in the data privacy notice and with the implicit
        or explicit consent of the data subject?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-07.1
      name: Data Privacy Requirements for Contractors & Service Providers
      description: Mechanisms exist to include data privacy requirements in contracts
        and other acquisition-related documents that establish data privacy roles
        and responsibilities for contractors and service providers.
      annotation: Does the organization include data privacy requirements in contracts
        and other acquisition-related documents that establish data privacy roles
        and responsibilities for contractors and service providers?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-07.2
      name: Joint Processing of Personal Data (PD)
      description: Mechanisms exist to clearly define and communicate the organization's
        role in processing Personal Data (PD) in the data processing ecosystem.
      annotation: Does the organization clearly define and communicate its role in
        processing Personal Data (PD) in the data processing ecosystem?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-07.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-07.3
      name: Obligation To Inform Third-Parties
      description: Mechanisms exist to inform applicable third-parties of any modification,
        deletion or other change that affects shared Personal Data (PD).
      annotation: Does the organization inform applicable third-parties of any modification,
        deletion or other change that affects shared Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-07.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-07.4
      name: Reject Unauthenticated or Untrustworthy Disclosure Requests
      description: Mechanisms exist to reject unauthenticated, or untrustworthy, disclosure
        requests.
      annotation: Does the organization reject unauthenticated, or untrustworthy,
        disclosure requests?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-07.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-07.5
      name: Justification To Reject Disclosure Requests
      description: "Mechanisms exist to reject data subject access requests that are\
        \ categorized as:\n(1) Harassing; \n(2) Repetitive; or\n(3) Fraudulent."
      annotation: "Does the organization reject data subject access requests that\
        \ are categorized as:\n (1) Harassing; \n (2) Repetitive; or\n (3) Fraudulent?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-08
      name: Testing, Training & Monitoring
      description: Mechanisms exist to conduct cybersecurity & data privacy testing,
        training and monitoring activities
      annotation: Does the organization conduct cybersecurity & data privacy testing,
        training and monitoring activities
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-09
      name: Personal Data (PD) Lineage
      description: Mechanisms exist to maintain a process to document the lineage
        of Personal Data (PD) by recording how the organization collects, receives,
        processes, stores, transmits, shares, updates and/or disposes of PD.
      annotation: Does the organization document the lineage of Personal Data (PD)
        by recording how the organization collects, receives, processes, stores, transmits,
        shares, updates and/or disposes of PD?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-10
      name: Data Quality Management
      description: Mechanisms exist to manage the quality, utility, objectivity, integrity
        and impact determination and de-identification of sensitive/regulated data
        across the information lifecycle.
      annotation: Does the organization manage the quality, utility, objectivity,
        integrity and impact determination and de-identification of sensitive/regulated
        data across the information lifecycle?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-10.1
      name: Automation
      description: Automated mechanisms exist to support the evaluation of data quality
        across the information lifecycle.
      annotation: Does the organization use automated mechanisms to support the evaluation
        of data quality across the information lifecycle?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-10.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-10.2
      name: Data Analytics Bias
      description: Mechanisms exist to evaluate its analytical processes for potential
        bias.
      annotation: Does the organization evaluate its analytical processes for potential
        bias?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-11
      name: Data Tagging
      description: Mechanisms exist to issue data modeling guidelines to support tagging
        of sensitive/regulated data.
      annotation: Does the organization issue data modeling guidelines to support
        tagging of sensitive/regulated data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-12
      name: Updating Personal Data (PD)
      description: Mechanisms exist to develop processes to identify and record the
        method under which Personal Data (PD) is updated and the frequency that such
        updates occur.
      annotation: Does the organization develop processes to identify and record the
        method under which Personal Data (PD) is updated and the frequency that such
        updates occur?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-12.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-12.1
      name: Enabling Data Subjects To Update Personal Data (PD)
      description: Mechanisms exist to enable data subjects to update their Personal
        Data (PD).
      annotation: Does the organization enable data subjects to update their Personal
        Data (PD)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-13
      name: Data Management Board
      description: Mechanisms exist to establish a written charter for a Data Management
        Board (DMB) and assigned organization-defined roles to the DMB.
      annotation: Does the organization establish a written charter for a Data Management
        Board (DMB) and assigned organization-defined roles to the DMB?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-14
      name: Documenting Data Processing Activities
      description: Mechanisms exist to document Personal Data (PD) processing activities
        that cover collecting, receiving, processing, storing, transmitting, updating,
        sharing and disposal actions with sufficient detail to demonstrate conformity
        with applicable statutory, regulatory and contractual requirements.
      annotation: Does the organization document Personal Data (PD) processing activities
        that cover collecting, receiving, processing, storing, transmitting, updating,
        sharing and disposal actions with sufficient detail to demonstrate conformity
        with applicable statutory, regulatory and contractual requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-14.1
      name: Accounting of Disclosures
      description: 'Mechanisms exist to provide data subjects with an accounting of
        disclosures of their Personal Data (PD) controlled by:

        (1) The organization; and/or

        (2) Relevant third-parties that their PD was shared with.'
      annotation: 'Does the organization provide data subjects with an accounting
        of disclosures of their Personal Data (PD) controlled by:

        (1) The organization; and/or

        (2) Relevant third-parties that their PD was shared with?'
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-14.2
      name: Notification of Disclosure Request To Data Subject
      description: Mechanisms exist to notify data subjects of applicable legal requests
        to disclose Personal Data (PD).
      annotation: Does the organization notify data subjects of applicable legal requests
        to disclose Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-15
      name: Register As A Data Controller and/or Data Processor
      description: Mechanisms exist to register as a data controller and/or data processor,
        including registering databases containing Personal Data (PD) with the appropriate
        Data Authority, when necessary.
      annotation: Does the organization register as a data controller and/or data
        processor, including registering databases containing Personal Data (PD) with
        the appropriate Data Authority, when necessary?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-16
      name: Potential Human Rights Abuses
      description: Mechanisms exist to constrain the supply of physical and/or digital
        activity logs to the host government that can directly lead to contravention
        of the Universal Declaration of Human Rights (UDHR), as well as other applicable
        statutory, regulatory and/or contractual obligations.
      annotation: Does the organization constrain the supply of physical and/or digital
        activity logs to the host government that can directly lead to contravention
        of the Universal Declaration of Human Rights (UDHR), as well as other applicable
        statutory, regulatory and/or contractual obligations?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-17
      name: Data Subject Communications
      description: Mechanisms exist to craft disclosures and communications to data
        subjects in a manner that is concise, unambiguous and understandable by a
        reasonable person.
      annotation: Does the organization craft disclosures and communications to data
        subjects in a manner that is concise, unambiguous and understandable by a
        reasonable person?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-17.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-17.1
      name: Conspicuous Link To Data Privacy Notice
      description: Mechanisms exist to include a conspicuous link to the organization's
        data privacy notice on all consumer-facing websites and mobile applications.
      annotation: Does the organization include a conspicuous link to its data privacy
        notice on all consumer-facing websites and mobile applications?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-17.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-17.2
      name: Notice of Financial Incentive
      description: Mechanisms exist to provide data subjects with a Notice of Financial
        Incentive that explains the material terms of a financial incentive, price
        or service difference so the data subject can make an informed decision about
        whether to participate.
      annotation: Does the organization provide data subjects with a Notice of Financial
        Incentive that explains the material terms of a financial incentive, price
        or service difference so the data subject can make an informed decision about
        whether to participate?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:pri
      ref_id: PRI-18
      name: Data Controller Communications
      description: "Mechanisms exist to receive and process data controller communications\
        \ pertaining to:\n(1) Receiving and responding to data subject requests;\n\
        (2) Updating/correcting Personal Data (PD); \n(3) Accounting for disclosures\
        \ of PD; and\n(4) Accounting for PD that is stored, processed and/or transmitted\
        \ on behalf of the data controller."
      annotation: "Does the organization receive and process data controller communications\
        \ pertaining to:\n (1) Receiving and responding to data subject requests;\n\
        \ (2) Updating/correcting Personal Data (PD); \n (3) Accounting for disclosures\
        \ of PD; and\n (4) Accounting for PD that is stored, processed and/or transmitted\
        \ on behalf of the data controller?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      assessable: false
      depth: 1
      ref_id: PRM
      name: Project & Resource Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-01
      name: Cybersecurity & Data Privacy Portfolio Management
      description: Mechanisms exist to facilitate the implementation of cybersecurity
        & data privacy-related resource planning controls that define a viable plan
        for achieving cybersecurity & data privacy objectives.
      annotation: Does the organization facilitate the implementation of cybersecurity
        & data privacy-related resource planning controls that define a viable plan
        for achieving cybersecurity & data privacy objectives?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-01.1
      name: Strategic Plan & Objectives
      description: Mechanisms exist to establish a strategic cybersecurity & data
        privacy-specific business plan and set of objectives to achieve that plan.
      annotation: Does the organization establish a strategic cybersecurity & data
        privacy-specific business plan and set of objectives to achieve that plan?
      implementation_groups:
      - tier1
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-01.2
      name: Targeted Capability Maturity Levels
      description: Mechanisms exist to define and identify targeted capability maturity
        levels.
      annotation: Does the organization define and identify targeted capability maturity
        levels?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-02
      name: Cybersecurity & Data Privacy Resource Management
      description: Mechanisms exist to address all capital planning and investment
        requests, including the resources needed to implement the cybersecurity &
        data privacy programs and document all exceptions to this requirement.
      annotation: Does the organization address all capital planning and investment
        requests, including the resources needed to implement the cybersecurity &
        data privacy programs and document all exceptions to this requirement?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-03
      name: Allocation of Resources
      description: Mechanisms exist to identify and allocate resources for management,
        operational, technical and data privacy requirements within business process
        planning for projects / initiatives.
      annotation: Does the organization identify and allocate resources for management,
        operational, technical and data privacy requirements within business process
        planning for projects / initiatives?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-04
      name: Cybersecurity & Data Privacy In Project Management
      description: Mechanisms exist to assess cybersecurity & data privacy controls
        in system project development to determine the extent to which the controls
        are implemented correctly, operating as intended and producing the desired
        outcome with respect to meeting the requirements.
      annotation: Does the organization assess cybersecurity & data privacy controls
        in system project development to determine the extent to which the controls
        are implemented correctly, operating as intended and producing the desired
        outcome with respect to meeting the requirements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-05
      name: Cybersecurity & Data Privacy Requirements Definition
      description: Mechanisms exist to identify critical system components and functions
        by performing a criticality analysis for critical systems, system components
        or services at pre-defined decision points in the Secure Development Life
        Cycle (SDLC).
      annotation: Does the organization identify critical system components and functions
        by performing a criticality analysis for critical systems, system components
        or services at pre-defined decision points in the Secure Development Life
        Cycle (SDLC)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-06
      name: Business Process Definition
      description: "Mechanisms exist to define business processes with consideration\
        \ for cybersecurity & data privacy that determines: \n(1) The resulting risk\
        \ to organizational operations, assets, individuals and other organizations;\
        \ and\n(2) Information protection needs arising from the defined business\
        \ processes and revises the processes as necessary, until an achievable set\
        \ of protection needs is obtained."
      annotation: "Does the organization define business processes with consideration\
        \ for cybersecurity & data privacy that determines: \n (1) The resulting risk\
        \ to organizational operations, assets, individuals and other organizations;\
        \ and\n (2) Information protection needs arising from the defined business\
        \ processes and revises the processes as necessary, until an achievable set\
        \ of protection needs is obtained?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-07
      name: Secure Development Life Cycle (SDLC) Management
      description: Mechanisms exist to ensure changes to systems within the Secure
        Development Life Cycle (SDLC) are controlled through formal change control
        procedures.
      annotation: Does the organization ensure changes to systems within the Secure
        Development Life Cycle (SDLC) are controlled through formal change control
        procedures?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:prm
      ref_id: PRM-08
      name: Manage Organizational Knowledge
      description: Mechanisms exist to manage the organizational knowledge of the
        cybersecurity & data privacy staff.
      annotation: Does the organization manage the organizational knowledge of the
        cybersecurity & data privacy staff?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      assessable: false
      depth: 1
      ref_id: RSK
      name: Risk Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-01
      name: Risk Management Program
      description: Mechanisms exist to facilitate the implementation of strategic,
        operational and tactical risk management controls.
      annotation: Does the organization facilitate the implementation of strategic,
        operational and tactical risk management controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-01.1
      name: Risk Framing
      description: 'Mechanisms exist to identify:

        (1) Assumptions affecting risk assessments, risk response and risk monitoring;

        (2) Constraints affecting risk assessments, risk response and risk monitoring;

        (3) The organizational risk tolerance; and

        (4) Priorities, benefits and trade-offs considered by the organization for
        managing risk.'
      annotation: "Does the organization identify:\n (1) Assumptions affecting risk\
        \ assessments, risk response and risk monitoring;\n (2) Constraints affecting\
        \ risk assessments, risk response and risk monitoring;\n (3) The organizational\
        \ risk tolerance; and\n (4) Priorities, benefits and trade-offs considered\
        \ by the organization for managing risk?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-01.2
      name: Risk Management Resourcing
      description: Mechanisms exist to reduce the magnitude or likelihood of potential
        impacts by resourcing the capability required to manage technology-related
        risks.
      annotation: Does the organization reduce the magnitude or likelihood of potential
        impacts by resourcing the capability required to manage technology-related
        risks?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-01.3
      name: Risk Tolerance
      description: Mechanisms exist to define organizational risk tolerance, the specified
        range of acceptable results.
      annotation: Does the organization define organizational risk tolerance, the
        specified range of acceptable results?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-01.4
      name: Risk Threshold
      description: Mechanisms exist to define organizational risk threshold, the level
        of risk exposure above which risks are addressed and below which risks may
        be accepted.
      annotation: Does the organization define organizational risk threshold, the
        level of risk exposure above which risks are addressed and below which risks
        may be accepted?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-01.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-01.5
      name: Risk Appetite
      description: Mechanisms exist to define organizational risk appetite, the degree
        of uncertainty the organization is willing to accept in anticipation of a
        reward.
      annotation: Does the organization define organizational risk appetite, the degree
        of uncertainty the organization is willing to accept in anticipation of a
        reward?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-02
      name: Risk-Based Security Categorization
      description: 'Mechanisms exist to categorize systems and data in accordance
        with applicable laws, regulations and contractual obligations that:

        (1) Document the security categorization results (including supporting rationale)
        in the security plan for systems; and

        (2) Ensure the security categorization decision is reviewed and approved by
        the asset owner.'
      annotation: "Does the organization categorize systems and data in accordance\
        \ with applicable laws, regulations and contractual obligations that:\n (1)\
        \ Document the security categorization results (including supporting rationale)\
        \ in the security plan for systems; and\n (2) Ensure the security categorization\
        \ decision is reviewed and approved by the asset owner?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-02.1
      name: Impact-Level Prioritization
      description: Mechanisms exist to prioritize the impact level for systems, applications
        and/or services to prevent potential disruptions.
      annotation: Does the organization prioritize the impact level for systems, applications
        and/or services to prevent potential disruptions?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-03
      name: Risk Identification
      description: Mechanisms exist to identify and document risks, both internal
        and external.
      annotation: Does the organization identify and document risks, both internal
        and external?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-03.1
      name: Risk Catalog
      description: Mechanisms exist to develop and keep current a catalog of applicable
        risks associated with the organization's business operations and technologies
        in use.
      annotation: Does the organization develop and keep current a catalog of applicable
        risks associated with its business operations and technologies in use?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-04
      name: Risk Assessment
      description: Mechanisms exist to conduct recurring assessments of risk that
        includes the likelihood and magnitude of harm, from unauthorized access, use,
        disclosure, disruption, modification or destruction of the organization's
        systems and data.
      annotation: Does the organization conduct recurring assessments of risk that
        includes the likelihood and magnitude of harm, from unauthorized access, use,
        disclosure, disruption, modification or destruction of its systems and data?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-04.1
      name: Risk Register
      description: Mechanisms exist to maintain a risk register that facilitates monitoring
        and reporting of risks.
      annotation: Does the organization maintain a risk register that facilitates
        monitoring and reporting of risks?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-04.2
      name: Risk Assessment Methodology
      description: Mechanisms exist to implement a risk assessment methodology to
        ensure coverage for organizational components relevant for secure, compliant
        and resilient operations.
      annotation: Does the organization implement a risk assessment methodology to
        ensure coverage for organizational components relevant for secure, compliant
        and resilient operations?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-05
      name: Risk Ranking
      description: Mechanisms exist to identify and assign a risk ranking to newly
        discovered security vulnerabilities that is based on industry-recognized practices.
      annotation: Does the organization identify and assign a risk ranking to newly
        discovered security vulnerabilities that is based on industry-recognized practices?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-06
      name: Risk Remediation
      description: Mechanisms exist to remediate risks to an acceptable level.
      annotation: Does the organization remediate risks to an acceptable level?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-06.1
      name: Risk Response
      description: Mechanisms exist to respond to findings from cybersecurity & data
        privacy assessments, incidents and audits to ensure proper remediation has
        been performed.
      annotation: Does the organization respond to findings from cybersecurity & data
        privacy assessments, incidents and audits to ensure proper remediation has
        been performed?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-06.2
      name: Compensating Countermeasures
      description: Mechanisms exist to identify and implement compensating countermeasures
        to reduce risk and exposure to threats.
      annotation: Does the organization identify and implement compensating countermeasures
        to reduce risk and exposure to threats?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-07
      name: Risk Assessment Update
      description: Mechanisms exist to routinely update risk assessments and react
        accordingly upon identifying new security vulnerabilities, including using
        outside sources for security vulnerability information.
      annotation: Does the organization routinely update risk assessments and react
        accordingly upon identifying new security vulnerabilities, including using
        outside sources for security vulnerability information?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-08
      name: Business Impact Analysis (BIA)
      description: Mechanisms exist to conduct a Business Impact Analysis (BIA) to
        identify and assess cybersecurity and data protection risks.
      annotation: Does the organization conduct a Business Impact Analysis (BIA) to
        identify and assess cybersecurity and data protection risks?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-09
      name: Supply Chain Risk Management (SCRM) Plan
      description: Mechanisms exist to develop a plan for Supply Chain Risk Management
        (SCRM) associated with the development, acquisition, maintenance and disposal
        of systems, system components and services, including documenting selected
        mitigating actions and monitoring performance against those plans.
      annotation: Does the organization develop a plan for Supply Chain Risk Management
        (SCRM) associated with the development, acquisition, maintenance and disposal
        of systems, system components and services, including documenting selected
        mitigating actions and monitoring performance against those plans?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-09.1
      name: Supply Chain Risk Assessment
      description: Mechanisms exist to periodically assess supply chain risks associated
        with systems, system components and services.
      annotation: Does the organization periodically assess supply chain risks associated
        with systems, system components and services?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-09.2
      name: AI & Autonomous Technologies Supply Chain Impacts
      description: Mechanisms exist to address Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related risks and benefits arising from the organization's
        supply chain, including third-party software and data.
      annotation: Does the organization address Artificial Intelligence (AI) and Autonomous
        Technologies (AAT)-related risks and benefits arising from its supply chain,
        including third-party software and data?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-10
      name: Data Protection Impact Assessment (DPIA)
      description: Mechanisms exist to conduct a Data Protection Impact Assessment
        (DPIA) on systems, applications and services that store, process and/or transmit
        Personal Data (PD) to identify and remediate reasonably-expected risks.
      annotation: Does the organization conduct a Data Protection Impact Assessment
        (DPIA) on systems, applications and services that store, process and/or transmit
        Personal Data (PD) to identify and remediate reasonably-expected risks?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-11
      name: Risk Monitoring
      description: Mechanisms exist to ensure risk monitoring as an integral part
        of the continuous monitoring strategy that includes monitoring the effectiveness
        of cybersecurity & data privacy controls, compliance and change management.
      annotation: Does the organization ensure risk monitoring as an integral part
        of the continuous monitoring strategy that includes monitoring the effectiveness
        of cybersecurity & data privacy controls, compliance and change management?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:rsk
      ref_id: RSK-12
      name: Risk Culture
      description: Mechanisms exist to ensure teams are committed to a culture that
        considers and communicates technology-related risk.
      annotation: Does the organization ensure teams are committed to a culture that
        considers and communicates technology-related risk?
      implementation_groups:
      - tier1
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      assessable: false
      depth: 1
      ref_id: SEA
      name: Secure Engineering & Architecture
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-01
      name: Secure Engineering Principles
      description: Mechanisms exist to facilitate the implementation of industry-recognized
        cybersecurity & data privacy practices in the specification, design, development,
        implementation and modification of systems and services.
      annotation: Does the organization facilitate the implementation of industry-recognized
        cybersecurity & data privacy practices in the specification, design, development,
        implementation and modification of systems and services?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-01.1
      name: Centralized Management of Cybersecurity & Data Privacy Controls
      description: Mechanisms exist to centrally-manage the organization-wide management
        and implementation of cybersecurity & data privacy controls and related processes.
      annotation: Does the organization centrally-manage the organization-wide management
        and implementation of cybersecurity & data privacy controls and related processes?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-01.2
      name: Achieving Resilience Requirements
      description: Mechanisms exist to achieve resilience requirements in normal and
        adverse situations.
      annotation: Does the organization achieve resilience requirements in normal
        and adverse situations?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-02
      name: Alignment With Enterprise Architecture
      description: Mechanisms exist to develop an enterprise architecture, aligned
        with industry-recognized leading practices, with consideration for cybersecurity
        & data privacy principles that addresses risk to organizational operations,
        assets, individuals, other organizations.
      annotation: Does the organization develop an enterprise architecture, aligned
        with industry-recognized leading practices, with consideration for cybersecurity
        & data privacy principles that addresses risk to organizational operations,
        assets, individuals, other organizations?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-02.1
      name: Standardized Terminology
      description: Mechanisms exist to standardize technology and process terminology
        to reduce confusion amongst groups and departments.
      annotation: Does the organization standardize technology and process terminology
        to reduce confusion amongst groups and departments?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-02.2
      name: Outsourcing Non-Essential Functions or Services
      description: Mechanisms exist to identify non-essential functions or services
        that are capable of being outsourced to external service providers and align
        with the organization's enterprise architecture and security standards.
      annotation: Does the organization identify non-essential functions or services
        that are capable of being outsourced to external service providers and align
        with its enterprise architecture and security standards?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-02.3
      name: Technical Debt Reviews
      description: "Mechanisms exist to conduct ongoing \u201Ctechnical debt\u201D\
        \ reviews of hardware and software technologies to remediate outdated and/or\
        \ unsupported technologies."
      annotation: "Does the organization conduct ongoing \u201Ctechnical debt\u201D\
        \ reviews of hardware and software technologies to remediate outdated and/or\
        \ unsupported technologies?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-03
      name: Defense-In-Depth (DiD) Architecture
      description: Mechanisms exist to implement security functions as a layered structure
        minimizing interactions between layers of the design and avoiding any dependence
        by lower layers on the functionality or correctness of higher layers.
      annotation: Does the organization implement security functions as a layered
        structure minimizing interactions between layers of the design and avoiding
        any dependence by lower layers on the functionality or correctness of higher
        layers?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-03.1
      name: System Partitioning
      description: Mechanisms exist to partition systems so that partitions reside
        in separate physical domains or environments.
      annotation: Does the organization partition systems so that partitions reside
        in separate physical domains or environments?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-03.2
      name: Application Partitioning
      description: Mechanisms exist to separate user functionality from system management
        functionality.
      annotation: Does the organization separate user functionality from system management
        functionality?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-04
      name: Process Isolation
      description: Mechanisms exist to implement a separate execution domain for each
        executing process.
      annotation: Does the organization implement a separate execution domain for
        each executing process?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-04.1
      name: Security Function Isolation
      description: Mechanisms exist to isolate security functions from non-security
        functions.
      annotation: Does the organization isolate security functions from non-security
        functions?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-04.2
      name: Hardware Separation
      description: Mechanisms exist to implement underlying hardware separation mechanisms
        to facilitate process separation.
      annotation: Does the organization implement underlying hardware separation mechanisms
        to facilitate process separation?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-04.3
      name: Thread Separation
      description: Mechanisms exist to maintain a separate execution domain for each
        thread in multi-threaded processing.
      annotation: Does the organization maintain a separate execution domain for each
        thread in multi-threaded processing?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-04.4
      name: System Privileges Isolation
      description: Mechanisms exist to isolate, or logically separate, any application,
        service and/or process running with system privileges.
      annotation: Does the organization isolate, or logically separate, any application,
        service and/or process running with system privileges?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-05
      name: Information In Shared Resources
      description: Mechanisms exist to prevent unauthorized and unintended information
        transfer via shared system resources.
      annotation: Does the organization prevent unauthorized and unintended information
        transfer via shared system resources?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-06
      name: Prevent Program Execution
      description: Automated mechanisms exist to prevent the execution of unauthorized
        software programs.
      annotation: Does the organization use automated mechanisms to prevent the execution
        of unauthorized software programs?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-07
      name: Predictable Failure Analysis
      description: Mechanisms exist to determine the Mean Time to Failure (MTTF) for
        system components in specific environments of operation.
      annotation: Does the organization determine the Mean Time to Failure (MTTF)
        for system components in specific environments of operation?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-07.1
      name: Technology Lifecycle Management
      description: Mechanisms exist to manage the usable lifecycles of technology
        assets.
      annotation: Does the organization manage the usable lifecycles of technology
        assets?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-07.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-07.2
      name: Fail Secure
      description: Mechanisms exist to enable systems to fail to an organization-defined
        known-state for types of failures, preserving system state information in
        failure.
      annotation: Does the organization enable systems to fail to an organization-defined
        known-state for types of failures, preserving system state information in
        failure?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-07.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-07.3
      name: Fail Safe
      description: Mechanisms exist to implement fail-safe procedures when failure
        conditions occur.
      annotation: Does the organization implement fail-safe procedures when failure
        conditions occur?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-08
      name: Non-Persistence
      description: Mechanisms exist to implement non-persistent system components
        and services that are initiated in a known state and terminated upon the end
        of the session of use or periodically at an organization-defined frequency.
      annotation: Does the organization implement non-persistent system components
        and services that are initiated in a known state and terminated upon the end
        of the session of use or periodically at an organization-defined frequency?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-08.1
      name: Refresh from Trusted Sources
      description: Mechanisms exist to ensure that software and data needed for information
        system component and service refreshes are obtained from trusted sources.
      annotation: Does the organization ensure that software and data needed for information
        system component and service refreshes are obtained from trusted sources?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-09
      name: Information Output Filtering
      description: Mechanisms exist to validate information output from software programs
        and/or applications to ensure that the information is consistent with the
        expected content.
      annotation: Does the organization validate information output from software
        programs and/or applications to ensure that the information is consistent
        with the expected content?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-09.1
      name: Limit Personal Data (PD) Dissemination
      description: Mechanisms exist to limit the dissemination of Personal Data (PD)
        to organization-defined elements identified in the Data Protection Impact
        Assessment (DPIA) and consistent with authorized purposes.
      annotation: Does the organization limit the dissemination of Personal Data (PD)
        to organization-defined elements identified in the Data Protection Impact
        Assessment (DPIA) and consistent with authorized purposes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-10
      name: Memory Protection
      description: Mechanisms exist to implement security safeguards to protect system
        memory from unauthorized code execution.
      annotation: Does the organization implement security safeguards to protect system
        memory from unauthorized code execution?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-11
      name: Honeypots
      description: Mechanisms exist to utilize honeypots that are specifically designed
        to be the target of malicious attacks for the purpose of detecting, deflecting
        and analyzing such attacks.
      annotation: Does the organization utilize honeypots that are specifically designed
        to be the target of malicious attacks for the purpose of detecting, deflecting
        and analyzing such attacks?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-12
      name: Honeyclients
      description: Mechanisms exist to utilize honeyclients that proactively seek
        to identify malicious websites and/or web-based malicious code.
      annotation: Does the organization utilize honeyclients that proactively seek
        to identify malicious websites and/or web-based malicious code?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-13
      name: Heterogeneity
      description: Mechanisms exist to utilize a diverse set of technologies for system
        components to reduce the impact of technical vulnerabilities from the same
        Original Equipment Manufacturer (OEM).
      annotation: Does the organization utilize a diverse set of technologies for
        system components to reduce the impact of technical vulnerabilities from the
        same Original Equipment Manufacturer (OEM)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-13.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-13.1
      name: Virtualization Techniques
      description: Mechanisms exist to utilize virtualization techniques to support
        the employment of a diversity of operating systems and applications.
      annotation: Does the organization utilize virtualization techniques to support
        the employment of a diversity of operating systems and applications?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-14
      name: Concealment & Misdirection
      description: Mechanisms exist to utilize concealment and misdirection techniques
        for systems to confuse and mislead adversaries.
      annotation: Does the organization utilize concealment and misdirection techniques
        for systems to confuse and mislead adversaries?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-14.1
      name: Randomness
      description: Automated mechanisms exist to introduce randomness into organizational
        operations and assets.
      annotation: Does the organization use automated mechanisms to introduce randomness
        into organizational operations and assets?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-14.2
      name: Change Processing & Storage Locations
      description: Automated mechanisms exist to change the location of processing
        and/or storage at random time intervals.
      annotation: Does the organization use automated mechanisms to change the location
        of processing and/or storage at random time intervals?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-15
      name: Distributed Processing & Storage
      description: Mechanisms exist to distribute processing and storage across multiple
        physical locations.
      annotation: Does the organization distribute processing and storage across multiple
        physical locations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-16
      name: Non-Modifiable Executable Programs
      description: Mechanisms exist to utilize non-modifiable executable programs
        that load and execute the operating environment and applications from hardware-enforced,
        read-only media.
      annotation: Does the organization utilize non-modifiable executable programs
        that load and execute the operating environment and applications from hardware-enforced,
        read-only media?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-17
      name: Secure Log-On Procedures
      description: Mechanisms exist to utilize a trusted communications path between
        the user and the security functions of the system.
      annotation: Does the organization utilize a trusted communications path between
        the user and the security functions of the system?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-18
      name: System Use Notification (Logon Banner)
      description: Mechanisms exist to utilize system use notification / logon banners
        that display an approved system use notification message or banner before
        granting access to the system that provides cybersecurity & data privacy notices.
      annotation: Does the organization utilize system use notification / logon banners
        that display an approved system use notification message or banner before
        granting access to the system that provides cybersecurity & data privacy notices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-18.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-18.1
      name: Standardized Microsoft Windows Banner
      description: Mechanisms exist to configure Microsoft Windows-based systems to
        display an approved logon banner before granting access to the system that
        provides cybersecurity & data privacy notices.
      annotation: Does the organization configure Microsoft Windows-based systems
        to display an approved logon banner before granting access to the system that
        provides cybersecurity & data privacy notices?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-18.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-18.2
      name: Truncated Banner
      description: Mechanisms exist to utilize a truncated system use notification
        / logon banner on systems not capable of displaying a logon banner from a
        centralized source, such as Active Directory.
      annotation: Does the organization utilize a truncated system use notification
        / logon banner on systems not capable of displaying a logon banner from a
        centralized source, such as Active Directory?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-19
      name: Previous Logon Notification
      description: Mechanisms exist to configure systems that process, store or transmit
        sensitive/regulated data to notify the user, upon successful logon, of the
        number of unsuccessful logon attempts since the last successful logon.
      annotation: Does the organization configure systems that process, store or transmit
        sensitive/regulated data to notify the user, upon successful logon, of the
        number of unsuccessful logon attempts since the last successful logon?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-20
      name: Clock Synchronization
      description: Mechanisms exist to utilize time-synchronization technology to
        synchronize all critical system clocks.
      annotation: Does the organization utilize time-synchronization technology to
        synchronize all critical system clocks?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sea
      ref_id: SEA-21
      name: Application Container
      description: Mechanisms exist to utilize an application container (virtualization
        approach) to isolate to a known set of dependencies, access methods and interfaces.
      annotation: Does the organization utilize an application container (virtualization
        approach) to isolate to a known set of dependencies, access methods and interfaces?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      assessable: false
      depth: 1
      ref_id: OPS
      name: Security Operations
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-01
      name: Operations Security
      description: Mechanisms exist to facilitate the implementation of operational
        security controls.
      annotation: Does the organization facilitate the implementation of operational
        security controls?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-01.1
      name: Standardized Operating Procedures (SOP)
      description: Mechanisms exist to identify and document Standardized Operating
        Procedures (SOP), or similar documentation, to enable the proper execution
        of day-to-day / assigned tasks.
      annotation: Does the organization identify and document Standardized Operating
        Procedures (SOP), or similar documentation, to enable the proper execution
        of day-to-day / assigned tasks?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-02
      name: Security Concept Of Operations (CONOPS)
      description: Mechanisms exist to develop a security Concept of Operations (CONOPS),
        or a similarly-defined plan for achieving cybersecurity objectives, that documents
        management, operational and technical measures implemented to apply defense-in-depth
        techniques that is communicated to all appropriate stakeholders.
      annotation: Does the organization develop a security Concept of Operations (CONOPS),
        or a similarly-defined plan for achieving cybersecurity objectives, that documents
        management, operational and technical measures implemented to apply defense-in-depth
        techniques that is communicated to all appropriate stakeholders?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-03
      name: 'Service Delivery

        (Business Process Support)'
      description: Mechanisms exist to define supporting business processes and implement
        appropriate governance and service management to ensure appropriate planning,
        delivery and support of the organization's technology capabilities supporting
        business functions, workforce, and/or customers based on industry-recognized
        standards to achieve the specific goals of the process area.
      annotation: Does the organization define supporting business processes and implement
        appropriate governance and service management to ensure appropriate planning,
        delivery and support of its technology capabilities supporting business functions,
        workforce, and/or customers based on industry-recognized standards to achieve
        the specific goals of the process area?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-04
      name: Security Operations Center (SOC)
      description: Mechanisms exist to establish and maintain a Security Operations
        Center (SOC) that facilitates a 24x7 response capability.
      annotation: Does the organization establish and maintain a Security Operations
        Center (SOC) that facilitates a 24x7 response capability?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-05
      name: Secure Practices Guidelines
      description: Mechanisms exist to provide guidelines and recommendations for
        the secure use of products and/or services to assist in the configuration,
        installation and use of the product and/or service.
      annotation: Does the organization provide guidelines and recommendations for
        the secure use of products and/or services to assist in the configuration,
        installation and use of the product and/or service?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-06
      name: Security Orchestration, Automation, and Response (SOAR)
      description: Mechanisms exist to utilize Security Orchestration, Automation
        and Response (SOAR) tools to define, prioritize and automate the response
        to security incidents.
      annotation: Does the organization utilize Security Orchestration, Automation
        and Response (SOAR) tools to define, prioritize and automate the response
        to security incidents?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:ops
      ref_id: OPS-07
      name: Shadow Information Technology Detection
      description: Mechanisms exist to detect the presence of unauthorized software,
        systems and services in use.
      annotation: Does the organization detect the presence of unauthorized software,
        systems and services in use?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      assessable: false
      depth: 1
      ref_id: SAT
      name: Security Awareness & Training
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-01
      name: Cybersecurity & Data Privacy-Minded Workforce
      description: Mechanisms exist to facilitate the implementation of security workforce
        development and awareness controls.
      annotation: Does the organization facilitate the implementation of security
        workforce development and awareness controls?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-01.1
      name: Maintaining Workforce Development Relevancy
      description: 'Mechanisms exist to periodically review security workforce development
        and awareness training to account for changes to:

        (1) Organizational policies, standards and procedures;

        (2) Assigned roles and responsibilities;

        (3) Relevant threats and risks; and

        (4) Technological developments.'
      annotation: 'Does the organization periodically review security workforce development
        and awareness training to account for changes to:

        (1) Organizational policies, standards and procedures;

        (2) Assigned roles and responsibilities;

        (3) Relevant threats and risks; and

        (4) Technological developments?'
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-02
      name: Cybersecurity & Data Privacy Awareness Training
      description: Mechanisms exist to provide all employees and contractors appropriate
        awareness education and training that is relevant for their job function.
      annotation: Does the organization provide all employees and contractors appropriate
        awareness education and training that is relevant for their job function?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-02.1
      name: Simulated Cyber Attack Scenario Training
      description: Mechanisms exist to include simulated actual cyber-attacks through
        practical exercises that are aligned with current threat scenarios.
      annotation: Does the organization include simulated actual cyber-attacks through
        practical exercises that are aligned with current threat scenarios?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-02.2
      name: Social Engineering & Mining
      description: Mechanisms exist to include awareness training on recognizing and
        reporting potential and actual instances of social engineering and social
        mining.
      annotation: Does the organization include awareness training on recognizing
        and reporting potential and actual instances of social engineering and social
        mining?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03
      name: Role-Based Cybersecurity & Data Privacy Training
      description: "Mechanisms exist to provide role-based cybersecurity & data privacy-related\
        \ training: \n(1) Before authorizing access to the system or performing assigned\
        \ duties; \n(2) When required by system changes; and \n(3) Annually thereafter."
      annotation: "Does the organization provide role-based cybersecurity & data privacy-related\
        \ training: \n (1) Before authorizing access to the system or performing assigned\
        \ duties; \n (2) When required by system changes; and \n (3) Annually thereafter?"
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.1
      name: Practical Exercises
      description: Mechanisms exist to include practical exercises in cybersecurity
        & data privacy training that reinforce training objectives.
      annotation: Does the organization include practical exercises in cybersecurity
        & data privacy training that reinforce training objectives?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.2
      name: Suspicious Communications & Anomalous System Behavior
      description: Mechanisms exist to provide training to personnel on organization-defined
        indicators of malware to recognize suspicious communications and anomalous
        behavior.
      annotation: Does the organization provide training to personnel on organization-defined
        indicators of malware to recognize suspicious communications and anomalous
        behavior?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.3
      name: Sensitive / Regulated Data Storage, Handling & Processing
      description: Mechanisms exist to ensure that every user accessing a system processing,
        storing or transmitting sensitive / regulated data is formally trained in
        data handling requirements.
      annotation: Does the organization ensure that every user accessing a system
        processing, storing or transmitting sensitive / regulated data is formally
        trained in data handling requirements?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.4
      name: Vendor Cybersecurity & Data Privacy Training
      description: Mechanisms exist to incorporate vendor-specific security training
        in support of new technology initiatives.
      annotation: Does the organization incorporate vendor-specific security training
        in support of new technology initiatives?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.5
      name: Privileged Users
      description: Mechanisms exist to provide specific training for privileged users
        to ensure privileged users understand their unique roles and responsibilities
      annotation: Does the organization provide specific training for privileged users
        to ensure privileged users understand their unique roles and responsibilities
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.6
      name: Cyber Threat Environment
      description: Mechanisms exist to provide role-based cybersecurity & data privacy
        awareness training that is current and relevant to the cyber threats that
        users might encounter in day-to-day business operations.
      annotation: Does the organization provide role-based cybersecurity & data privacy
        awareness training that is current and relevant to the cyber threats that
        users might encounter in day-to-day business operations?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.7
      name: Continuing Professional Education (CPE) - Cybersecurity & Data Privacy
        Personnel
      description: Mechanisms exist to ensure cybersecurity & data privacy personnel
        receive Continuing Professional Education (CPE) training to maintain currency
        and proficiency with industry-recognized secure practices that are pertinent
        to their assigned roles and responsibilities.
      annotation: Does the organization ensure cybersecurity & data privacy personnel
        receive Continuing Professional Education (CPE) training to maintain currency
        and proficiency with industry-recognized secure practices that are pertinent
        to their assigned roles and responsibilities?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.8
      name: Continuing Professional Education (CPE) - DevOps Personnel
      description: Mechanisms exist to ensure application development and operations
        (DevOps) personnel receive Continuing Professional Education (CPE) training
        on Secure Software Development Practices (SSDP) to appropriately address evolving
        threats.
      annotation: Does the organization ensure application development and operations
        (DevOps) personnel receive Continuing Professional Education (CPE) training
        on Secure Software Development Practices (SSDP) to appropriately address evolving
        threats?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-03.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-03.9
      name: Counterintelligence Training
      description: Mechanisms exist to provide specialized counterintelligence awareness
        training that enables personnel to collect, interpret and act upon a range
        of data sources that may signal the presence of a hostile actor.
      annotation: Does the organization provide specialized counterintelligence awareness
        training that enables personnel to collect, interpret and act upon a range
        of data sources that may signal the presence of a hostile actor?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-04
      name: Cybersecurity & Data Privacy Training Records
      description: Mechanisms exist to document, retain and monitor individual training
        activities, including basic cybersecurity & data privacy awareness training,
        ongoing awareness training and specific-system training.
      annotation: Does the organization document, retain and monitor individual training
        activities, including basic cybersecurity & data privacy awareness training,
        ongoing awareness training and specific-system training?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:sat
      ref_id: SAT-05
      name: Cybersecurity Knowledge Sharing
      description: Mechanisms exist to improve cybersecurity and data protection knowledge
        sharing across security personnel allowing for more rapid and effective response
        to incidents.
      annotation: Does the organization improve cybersecurity and data protection
        knowledge sharing across security personnel allowing for more rapid and effective
        response to incidents?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      assessable: false
      depth: 1
      ref_id: TDA
      name: Technology Development & Acquisition
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-01
      name: Technology Development & Acquisition
      description: Mechanisms exist to facilitate the implementation of tailored development
        and acquisition strategies, contract tools and procurement methods to meet
        unique business needs.
      annotation: Does the organization facilitate the implementation of tailored
        development and acquisition strategies, contract tools and procurement methods
        to meet unique business needs?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-01.1
      name: Product Management
      description: "Mechanisms exist to design and implement product management processes\
        \ to proactively govern the design, development and production of products\
        \ and/or services across the System Development Life Cycle (SDLC) to:\n(1)\
        \ Improve functionality;\n(2) Enhance security and resiliency capabilities;\
        \ \n(3) Correct security deficiencies; and\n(4) Conform with applicable statutory,\
        \ regulatory and/or contractual obligations."
      annotation: "Does the organization design and implement product management processes\
        \ to proactively govern the design, development and production of products\
        \ and/or services across the System Development Life Cycle (SDLC) to:\n(1)\
        \ Improve functionality;\n(2) Enhance security and resiliency capabilities;\
        \ \n(3) Correct security deficiencies; and\n(4) Conform with applicable statutory,\
        \ regulatory and/or contractual obligations?"
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-01.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-01.2
      name: Integrity Mechanisms for Software / Firmware Updates
      description: Mechanisms exist to utilize integrity validation mechanisms for
        security updates.
      annotation: Does the organization utilize integrity validation mechanisms for
        security updates?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-01.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-01.3
      name: Malware Testing Prior to Release
      description: Mechanisms exist to utilize at least one(1) malware detection tool
        to identify if any known malware exists in the final binaries of the product
        or security update.
      annotation: Does the organization utilize at least one (1) malware detection
        tool to identify if any known malware exists in the final binaries of the
        product or security update?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-01.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-01.4
      name: DevSecOps
      description: Mechanisms exist to integrate cybersecurity and data privacy into
        Development, Security and Operations (DevSecOps) to prioritize secure practices
        throughout the Software Development Lifecycle (SDLC).
      annotation: Does the organization integrate cybersecurity and data privacy into
        emerging Development and Operations (DevOps) to prioritize secure practices
        throughout the Software Development Lifecycle (SDLC)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02
      name: Minimum Viable Product (MVP) Security Requirements
      description: Mechanisms exist to design, develop and produce products and/or
        services in such a way that risk-based technical and functional specifications
        ensure Minimum Viable Product (MVP) criteria establish an appropriate level
        of security and resiliency based on applicable risks and threats.
      annotation: Does the organization design, develop and produce products and/or
        services in such a way that risk-based technical and functional specifications
        ensure Minimum Viable Product (MVP) criteria establish an appropriate level
        of security and resiliency based on applicable risks and threats?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.1
      name: Ports, Protocols & Services In Use
      description: Mechanisms exist to require the developers of systems, system components
        or services to identify early in the Secure Development Life Cycle (SDLC),
        the functions, ports, protocols and services intended for use.
      annotation: Does the organization require the developers of systems, system
        components or services to identify early in the Secure Development Life Cycle
        (SDLC), the functions, ports, protocols and services intended for use?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.2
      name: Information Assurance Enabled Products
      description: Mechanisms exist to limit the use of commercially-provided Information
        Assurance (IA) and IA-enabled IT products to those products that have been
        successfully evaluated against a National Information Assurance partnership
        (NIAP)-approved Protection Profile or the cryptographic module is FIPS-validated
        or NSA-approved.
      annotation: Does the organization limit the use of commercially-provided Information
        Assurance (IA) and IA-enabled IT products to those products that have been
        successfully evaluated against a National Information Assurance partnership
        (NIAP)-approved Protection Profile or the cryptographic module is FIPS-validated
        or NSA-approved?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.3
      name: Development Methods, Techniques & Processes
      description: Mechanisms exist to require software developers to ensure that
        their software development processes employ industry-recognized secure practices
        for secure programming, engineering methods, quality control processes and
        validation techniques to minimize flawed and/or malformed software.
      annotation: Does the organization require software developers to ensure that
        their software development processes employ industry-recognized secure practices
        for secure programming, engineering methods, quality control processes and
        validation techniques to minimize flawed and/or malformed software?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.4
      name: Pre-Established Secure Configurations
      description: 'Mechanisms exist to ensure vendors / manufacturers:

        (1) Deliver the system, component, or service with a pre-established, secure
        configuration implemented; and

        (2) Use the pre-established, secure configuration as the default for any subsequent
        system, component, or service reinstallation or upgrade.'
      annotation: "Does the organization ensure vendors / manufacturers:\n (1) Deliver\
        \ the system, component, or service with a pre-established, secure configuration\
        \ implemented; and\n (2) Use the pre-established, secure configuration as\
        \ the default for any subsequent system, component, or service reinstallation\
        \ or upgrade?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.5
      name: Identification & Justification of Ports, Protocols & Services
      description: Mechanisms exist to require process owners to identify, document
        and justify the business need for the ports, protocols and other services
        necessary to operate their technology solutions.
      annotation: Does the organization require process owners to identify, document
        and justify the business need for the ports, protocols and other services
        necessary to operate their technology solutions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.6
      name: Insecure Ports, Protocols & Services
      description: Mechanisms exist to mitigate the risk associated with the use of
        insecure ports, protocols and services necessary to operate technology solutions.
      annotation: Does the organization mitigate the risk associated with the use
        of insecure ports, protocols and services necessary to operate technology
        solutions?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.7
      name: Cybersecurity & Data Privacy Representatives For Product Changes
      description: Mechanisms exist to include appropriate cybersecurity & data privacy
        representatives in the product feature and/or functionality change control
        review process.
      annotation: Does the organization include appropriate cybersecurity & data privacy
        representatives in the product feature and/or functionality change control
        review process?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.8
      name: Minimizing Attack Surfaces
      description: Mechanisms exist to minimize the attack surface of products and/or
        services by reasonably mitigating known exploitable vulnerabilities.
      annotation: Does the organization minimize the attack surface of products and/or
        services by reasonably mitigating known exploitable vulnerabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.9
      name: Ongoing Product Security Support
      description: 'Mechanisms exist to deliver security updates to products and/or
        services, where applicable, through:

        (1) Automatic updates; and

        (2) Notification of available updates to affected users.'
      annotation: 'Does the organization deliver security updates to products and/or
        services, where applicable, through:

        (1) Automatic updates; and

        (2) Notification of available updates to affected users?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.10
      name: Product Testing & Reviews
      description: Mechanisms exist to regularly review products and/or services for
        an appropriate level of security and resiliency based on applicable risks
        and threats.
      annotation: Does the organization regularly review products and/or services
        for an appropriate level of security and resiliency based on applicable risks
        and threats?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.11
      name: Disclosure of Vulnerabilities
      description: 'Mechanisms exist to disclose information about vulnerabilities
        to relevant stakeholders, including:

        (1) A description of the vulnerability(ies);

        (2) Affected product(s) and/or service(s);

        (3) Potential impact of the vulnerability(ies);

        (4) Severity of the vulnerability(ies); and

        (5) Guidance to remediate the vulnerability(ies).'
      annotation: 'Does the organization disclose information about vulnerabilities
        to relevant stakeholders, including:

        (1) A description of the vulnerability(ies);

        (2) Affected product(s) and/or service(s);

        (3) Potential impact of the vulnerability(ies);

        (4) Severity of the vulnerability(ies); and

        (5) Guidance to remediate the vulnerability(ies)?'
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.12
      name: Products With Digital Elements
      description: Mechanisms exist to categorize applicable security and resiliency
        requirements for products and/or services with digital elements.
      annotation: Does the organization categorize applicable security and resiliency
        requirements for products and/or services with digital elements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-02.13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-02.13
      name: Reporting Exploitable Vulnerabilities
      description: Mechanisms exist to notify applicable stakeholders about potentially
        exploitable vulnerabilities in organization-developed products and/or services,
        as required by statutory, regulatory and/or contractual obligations.
      annotation: Does the organization notify applicable stakeholders about potentially
        exploitable vulnerabilities in organization-developed products and/or services,
        as required by statutory, regulatory and/or contractual obligations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-03
      name: Commercial Off-The-Shelf (COTS) Security Solutions
      description: Mechanisms exist to utilize only Commercial Off-the-Shelf (COTS)
        security products.
      annotation: Does the organization utilize only Commercial Off-the-Shelf (COTS)
        security products?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-03.1
      name: Supplier Diversity
      description: Mechanisms exist to obtain cybersecurity & data privacy technologies
        from different suppliers to minimize supply chain risk.
      annotation: Does the organization obtain cybersecurity & data privacy technologies
        from different suppliers to minimize supply chain risk?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-04
      name: Documentation Requirements
      description: 'Mechanisms exist to obtain, protect and distribute administrator
        documentation for systems that describe:

        (1) Secure configuration, installation and operation of the system;

        (2) Effective use and maintenance of security features/functions; and

        (3) Known vulnerabilities regarding configuration and use of administrative
        (e.g., privileged) functions.'
      annotation: "Does the organization obtain, protect and distribute administrator\
        \ documentation for systems that describe:\n (1) Secure configuration, installation\
        \ and operation of the system;\n (2) Effective use and maintenance of security\
        \ features/functions; and\n (3) Known vulnerabilities regarding configuration\
        \ and use of administrative (e.g., privileged) functions?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-04.1
      name: Functional Properties
      description: Mechanisms exist to require software developers to provide information
        describing the functional properties of the security controls to be utilized
        within systems, system components or services in sufficient detail to permit
        analysis and testing of the controls.
      annotation: Does the organization require software developers to provide information
        describing the functional properties of the security controls to be utilized
        within systems, system components or services in sufficient detail to permit
        analysis and testing of the controls?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-04.2
      name: Software Bill of Materials (SBOM)
      description: Mechanisms exist to generate, or obtain, a Software Bill of Materials
        (SBOM) for systems, applications and services that lists software packages
        in use, including versions and applicable licenses.
      annotation: Does the organization generate, or obtain, a Software Bill of Materials
        (SBOM) for systems, applications and services that lists software packages
        in use, including versions and applicable licenses?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-05
      name: Developer Architecture & Design
      description: "Mechanisms exist to require the developers of systems, system\
        \ components or services to produce a design specification and security architecture\
        \ that: \n(1) Is consistent with and supportive of the organization's security\
        \ architecture which is established within and is an integrated part of the\
        \ organization's enterprise architecture;\n(2) Accurately and completely describes\
        \ the required security functionality and the allocation of security controls\
        \ among physical and logical components; and\n(3) Expresses how individual\
        \ security functions, mechanisms and services work together to provide required\
        \ security capabilities and a unified approach to protection."
      annotation: "Does the organization require the developers of systems, system\
        \ components or services to produce a design specification and security architecture\
        \ that: \n (1) Is consistent with and supportive of its security architecture\
        \ which is established within and is an integrated part of its enterprise\
        \ architecture;\n (2) Accurately and completely describes the required security\
        \ functionality and the allocation of security controls among physical and\
        \ logical components; and\n (3) Expresses how individual security functions,\
        \ mechanisms and services work together to provide required security capabilities\
        \ and a unified approach to protection?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-05.1
      name: Physical Diagnostic & Test Interfaces
      description: Mechanisms exist to secure physical diagnostic and test interfaces
        to prevent misuse.
      annotation: Does the organization secure physical diagnostic and test interfaces
        to prevent misuse?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-05.2
      name: Diagnostic & Test Interface Monitoring
      description: Mechanisms exist to enable endpoint devices to log events and generate
        alerts for attempts to access diagnostic and test interfaces.
      annotation: Does the organization enable endpoint devices to log events and
        generate alerts for attempts to access diagnostic and test interfaces?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-06
      name: Secure Software Development Practices (SSDP)
      description: Mechanisms exist to develop applications based on Secure Software
        Development Practices (SSDP).
      annotation: Does the organization develop applications based on Secure Software
        Development Practices (SSDP)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-06.1
      name: Criticality Analysis
      description: Mechanisms exist to require the developer of the system, system
        component or service to perform a criticality analysis at organization-defined
        decision points in the Secure Development Life Cycle (SDLC).
      annotation: Does the organization require the developer of the system, system
        component or service to perform a criticality analysis at organization-defined
        decision points in the Secure Development Life Cycle (SDLC)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-06.2
      name: Threat Modeling
      description: Mechanisms exist to perform threat modelling and other secure design
        techniques, to ensure that threats to software and solutions are identified
        and accounted for.
      annotation: Does the organization perform threat modelling and other secure
        design techniques, to ensure that threats to software and solutions are identified
        and accounted for?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-06.3
      name: Software Assurance Maturity Model (SAMM)
      description: Mechanisms exist to utilize a Software Assurance Maturity Model
        (SAMM) to govern a secure development lifecycle for the development of systems,
        applications and services.
      annotation: Does the organization utilize a Software Assurance Maturity Model
        (SAMM) to govern a secure development lifecycle for the development of systems,
        applications and services?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-06.4
      name: Supporting Toolchain
      description: Automated mechanisms exist to improve the accuracy, consistency
        and comprehensiveness of secure practices throughout the asset's lifecycle.
      annotation: Does the organization use automated mechanisms to improve the accuracy,
        consistency and comprehensiveness of secure practices throughout the asset's
        lifecycle?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-06.5
      name: Software Design Review
      description: Mechanisms exist to have an independent review of the software
        design to confirm that all cybersecurity & data privacy requirements are met
        and that any identified risks are satisfactorily addressed.
      annotation: Does the organization have an independent review of the software
        design to confirm that all cybersecurity & data privacy requirements are met
        and that any identified risks are satisfactorily addressed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-07
      name: Secure Development Environments
      description: Mechanisms exist to maintain a segmented development network to
        ensure a secure development environment.
      annotation: Does the organization maintain a segmented development network to
        ensure a secure development environment?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-08
      name: Separation of Development, Testing and Operational Environments
      description: Mechanisms exist to manage separate development, testing and operational
        environments to reduce the risks of unauthorized access or changes to the
        operational environment and to ensure no impact to production systems.
      annotation: Does the organization manage separate development, testing and operational
        environments to reduce the risks of unauthorized access or changes to the
        operational environment and to ensure no impact to production systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-08.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-08.1
      name: Secure Migration Practices
      description: Mechanisms exist to ensure secure migration practices purge systems,
        applications and services of test/development/staging data and accounts before
        it is migrated into a production environment.
      annotation: Does the organization ensure secure migration practices purge systems,
        applications and services of test/development/staging data and accounts before
        it is migrated into a production environment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09
      name: Cybersecurity & Data Privacy Testing Throughout Development
      description: "Mechanisms exist to require system developers/integrators consult\
        \ with cybersecurity & data privacy personnel to: \n(1) Create and implement\
        \ a Security Testing and Evaluation (ST&E) plan, or similar capability;\n\
        (2) Implement a verifiable flaw remediation process to correct weaknesses\
        \ and deficiencies identified during the security testing and evaluation process;\
        \ and\n(3) Document the results of the security testing/evaluation and flaw\
        \ remediation processes."
      annotation: "Does the organization require system developers/integrators consult\
        \ with cybersecurity & data privacy personnel to: \n (1) Create and implement\
        \ a Security Testing and Evaluation (ST&E) plan, or similar capability;\n\
        \ (2) Implement a verifiable flaw remediation process to correct weaknesses\
        \ and deficiencies identified during the security testing and evaluation process;\
        \ and\n (3) Document the results of the security testing/evaluation and flaw\
        \ remediation processes?"
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.1
      name: Continuous Monitoring Plan
      description: Mechanisms exist to require the developers of systems, system components
        or services to produce a plan for the continuous monitoring of cybersecurity
        & data privacy control effectiveness.
      annotation: Does the organization require the developers of systems, system
        components or services to produce a plan for the continuous monitoring of
        cybersecurity & data privacy control effectiveness?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.2
      name: Static Code Analysis
      description: Mechanisms exist to require the developers of systems, system components
        or services to employ static code analysis tools to identify and remediate
        common flaws and document the results of the analysis.
      annotation: Does the organization require the developers of systems, system
        components or services to employ static code analysis tools to identify and
        remediate common flaws and document the results of the analysis?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.3
      name: Dynamic Code Analysis
      description: Mechanisms exist to require the developers of systems, system components
        or services to employ dynamic code analysis tools to identify and remediate
        common flaws and document the results of the analysis.
      annotation: Does the organization require the developers of systems, system
        components or services to employ dynamic code analysis tools to identify and
        remediate common flaws and document the results of the analysis?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.4
      name: Malformed Input Testing
      description: Mechanisms exist to utilize testing methods to ensure systems,
        services and products continue to operate as intended when subject to invalid
        or unexpected inputs on its interfaces.
      annotation: Does the organization utilize testing methods to ensure systems,
        services and products continue to operate as intended when subject to invalid
        or unexpected inputs on its interfaces?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.5
      name: Application Penetration Testing
      description: Mechanisms exist to perform application-level penetration testing
        of custom-made applications and services.
      annotation: Does the organization perform application-level penetration testing
        of custom-made applications and services?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.6
      name: Secure Settings By Default
      description: Mechanisms exist to implement secure configuration settings by
        default to reduce the likelihood of software being deployed with weak security
        settings that would put the asset at a greater risk of compromise.
      annotation: Does the organization implement secure configuration settings by
        default to reduce the likelihood of software being deployed with weak security
        settings that would put the asset at a greater risk of compromise?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-09.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-09.7
      name: Manual Code Review
      description: "Mechanisms exist to require the developers of systems, system\
        \ components or services to employ a manual code review process to identify\
        \ and remediate unique flaws that require knowledge of the application\u2019\
        s requirements and design."
      annotation: "Does the organization require the developers of systems, system\
        \ components or services to employ a manual code review process to identify\
        \ and remediate unique flaws that require knowledge of the application\u2019\
        s requirements and design?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-10
      name: Use of Live Data
      description: Mechanisms exist to approve, document and control the use of live
        data in development and test environments.
      annotation: Does the organization approve, document and control the use of live
        data in development and test environments?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-10.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-10.1
      name: Test Data Integrity
      description: Mechanisms exist to ensure the integrity of test data through existing
        cybersecurity & data privacy controls.
      annotation: Does the organization ensure the integrity of test data through
        existing cybersecurity & data privacy controls?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-11
      name: Product Tampering and Counterfeiting (PTC)
      description: Mechanisms exist to maintain awareness of component authenticity
        by developing and implementing Product Tampering and Counterfeiting (PTC)
        practices that include the means to detect and prevent counterfeit components.
      annotation: Does the organization maintain awareness of component authenticity
        by developing and implementing Product Tampering and Counterfeiting (PTC)
        practices that include the means to detect and prevent counterfeit components?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-11.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-11.1
      name: Anti-Counterfeit Training
      description: Mechanisms exist to train personnel to detect counterfeit system
        components, including hardware, software and firmware.
      annotation: Does the organization train personnel to detect counterfeit system
        components, including hardware, software and firmware?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-11.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-11.2
      name: Component Disposal
      description: '[deprecated - incorporated into AST-09]

        Mechanisms exist to dispose of system components using organization-defined
        techniques and methods to prevent such components from entering the gray market.'
      annotation: '[deprecated - incorporated into AST-09]

        Does the organization dispose of system components using organization-defined
        techniques and methods to prevent such components from entering the gray market?'
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-12
      name: Customized Development of Critical Components
      description: Mechanisms exist to custom-develop critical system components,
        when Commercial Off The Shelf (COTS) solutions are unavailable.
      annotation: Does the organization custom-develop critical system components,
        when Commercial Off The Shelf (COTS) solutions are unavailable?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-13
      name: Developer Screening
      description: Mechanisms exist to ensure that the developers of systems, applications
        and/or services have the requisite skillset and appropriate access authorizations.
      annotation: Does the organization ensure that the developers of systems, applications
        and/or services have the requisite skillset and appropriate access authorizations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-14
      name: Developer Configuration Management
      description: Mechanisms exist to require system developers and integrators to
        perform configuration management during system design, development, implementation
        and operation.
      annotation: Does the organization require system developers and integrators
        to perform configuration management during system design, development, implementation
        and operation?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-14.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-14.1
      name: Software / Firmware Integrity Verification
      description: Mechanisms exist to require developer of systems, system components
        or services to enable integrity verification of software and firmware components.
      annotation: Does the organization require developer of systems, system components
        or services to enable integrity verification of software and firmware components?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-14.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-14.2
      name: Hardware Integrity Verification
      description: Mechanisms exist to require developer of systems, system components
        or services to enable integrity verification of hardware components.
      annotation: Does the organization require developer of systems, system components
        or services to enable integrity verification of hardware components?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-15
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-15
      name: Developer Threat Analysis & Flaw Remediation
      description: Mechanisms exist to require system developers and integrators to
        develop and implement an ongoing Security Testing and Evaluation (ST&E) plan,
        or similar process, to objectively identify and remediate vulnerabilities
        prior to release to production.
      annotation: Does the organization require system developers and integrators
        to create a Security Testing and Evaluation (ST&E) plan and implement the
        plan under the witness of an independent party?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-16
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-16
      name: Developer-Provided Training
      description: Mechanisms exist to require the developers of systems, system components
        or services to provide training on the correct use and operation of the system,
        system component or service.
      annotation: Does the organization require the developers of systems, system
        components or services to provide training on the correct use and operation
        of the system, system component or service?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-17
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-17
      name: Unsupported Systems
      description: 'Mechanisms exist to prevent unsupported systems by:

        (1) Replacing systems when support for the components is no longer available
        from the developer, vendor or manufacturer; and

        (2) Requiring justification and documented approval for the continued use
        of unsupported system components required to satisfy mission/business needs.'
      annotation: "Does the organization prevent unsupported systems by:\n (1) Replacing\
        \ systems when support for the components is no longer available from the\
        \ developer, vendor or manufacturer; and\n (2) Requiring justification and\
        \ documented approval for the continued use of unsupported system components\
        \ required to satisfy mission/business needs?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-17.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-17.1
      name: Alternate Sources for Continued Support
      description: Mechanisms exist to provide in-house support or contract external
        providers for support with unsupported system components.
      annotation: Does the organization provide in-house support or contract external
        providers for support with unsupported system components?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-18
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-18
      name: Input Data Validation
      description: Mechanisms exist to check the validity of information inputs.
      annotation: Does the organization check the validity of information inputs?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-19
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-19
      name: Error Handling
      description: "Mechanisms exist to handle error conditions by: \n(1) Identifying\
        \ potentially security-relevant error conditions;\n(2) Generating error messages\
        \ that provide information necessary for corrective actions without revealing\
        \ sensitive or potentially harmful information in error logs and administrative\
        \ messages that could be exploited; and\n(3) Revealing error messages only\
        \ to authorized personnel."
      annotation: "Does the organization handle error conditions by: \n (1) Identifying\
        \ potentially security-relevant error conditions;\n (2) Generating error messages\
        \ that provide information necessary for corrective actions without revealing\
        \ sensitive or potentially harmful information in error logs and administrative\
        \ messages that could be exploited; and\n (3) Revealing error messages only\
        \ to authorized personnel?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-20
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-20
      name: Access to Program Source Code
      description: Mechanisms exist to limit privileges to change software resident
        within software libraries.
      annotation: Does the organization limit privileges to change software resident
        within software libraries?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-20.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-20.1
      name: Software Release Integrity Verification
      description: Mechanisms exist to publish integrity verification information
        for software releases.
      annotation: Does the organization publish integrity verification information
        for software releases?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-20.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-20.2
      name: Archiving Software Releases
      description: Mechanisms exist to archive software releases and all of their
        components (e.g., code, package files, third-party libraries, documentation)
        to maintain integrity verification information.
      annotation: Does the organization archive software releases and all of their
        components (e.g., code, package files, third-party libraries, documentation)
        to maintain integrity verification information?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-20.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-20.3
      name: Software Escrow
      description: Mechanisms exist to escrow source code and supporting documentation
        to ensure software availability in the event the software provider goes out
        of business or is unable to provide support.
      annotation: Does the organization escrow source code and supporting documentation
        to ensure software availability in the event the software provider goes out
        of business or is unable to provide support?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-21
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-21
      name: Product Conformity Governance
      description: 'Mechanisms exist to ensure developed products and/or services
        conform to applicable statutory and regulatory requirements, based on the
        product''s and/or service''s:

        (1) Use case(s); and

        (2) Geographic markets.'
      annotation: 'Does the organization ensure developed products and/or services
        conform to applicable statutory and regulatory requirements, based on the
        product''s and/or service''s:

        (1) Use case(s); and

        (2) Geographic markets?'
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-22
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-22
      name: Technical Documentation Artifacts
      description: Mechanisms exist to generate appropriate technical documentation
        artifacts for products and/or services in sufficient detail to demonstrate
        conformity with applicable statutory, regulatory and contractual compliance
        requirements.
      annotation: Does the organization generate appropriate technical documentation
        artifacts for products and/or services in sufficient detail to demonstrate
        conformity with applicable statutory, regulatory and contractual compliance
        requirements?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda-22.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tda
      ref_id: TDA-22.1
      name: Product-Specific Risk Assessment Artifacts
      description: Mechanisms exist to include a detailed cybersecurity risk assessment
        in the technical documentation for products and/or services to demonstrate
        applicable risks in approved use cases.
      annotation: Does the organization include a detailed cybersecurity risk assessment
        in the technical documentation for products and/or services to demonstrate
        applicable risks in approved use cases?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      assessable: false
      depth: 1
      ref_id: TPM
      name: Third-Party Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-01
      name: Third-Party Management
      description: Mechanisms exist to facilitate the implementation of third-party
        management controls.
      annotation: Does the organization facilitate the implementation of third-party
        management controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-01.1
      name: Third-Party Inventories
      description: Mechanisms exist to maintain a current, accurate and complete list
        of External Service Providers (ESPs) that can potentially impact the Confidentiality,
        Integrity, Availability and/or Safety (CIAS) of the organization's systems,
        applications, services and data.
      annotation: Does the organization maintain a current, accurate and complete
        list of External Service Providers (ESPs) that can potentially impact the
        Confidentiality, Integrity, Availability and/or Safety (CIAS) of its systems,
        applications, services and data?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-02
      name: Third-Party Criticality Assessments
      description: Mechanisms exist to identify, prioritize and assess suppliers and
        partners of critical systems, components and services using a supply chain
        risk assessment process relative to their importance in supporting the delivery
        of high-value services.
      annotation: Does the organization identify, prioritize and assess suppliers
        and partners of critical systems, components and services using a supply chain
        risk assessment process relative to their importance in supporting the delivery
        of high-value services?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-03
      name: Supply Chain Risk Management (SCRM)
      description: 'Mechanisms exist to:

        (1) Evaluate security risks and threats associated with the services and product
        supply chains; and

        (2) Take appropriate remediation actions to minimize the organization''s exposure
        to those risks and threats, as necessary.'
      annotation: 'Does the organization:

        (1) Evaluate security risks and threats associated with the services and product
        supply chains; and

        (2) Take appropriate remediation actions to minimize the organization''s exposure
        to those risks and threats, as necessary?'
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-03.1
      name: Acquisition Strategies, Tools & Methods
      description: Mechanisms exist to utilize tailored acquisition strategies, contract
        tools and procurement methods for the purchase of unique systems, system components
        or services.
      annotation: Does the organization utilize tailored acquisition strategies, contract
        tools and procurement methods for the purchase of unique systems, system components
        or services?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-03.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-03.2
      name: Limit Potential Harm
      description: Mechanisms exist to utilize security safeguards to limit harm from
        potential adversaries who identify and target the organization's supply chain.
      annotation: Does the organization utilize security safeguards to limit harm
        from potential adversaries who identify and target its supply chain?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-03.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-03.3
      name: Processes To Address Weaknesses or Deficiencies
      description: Mechanisms exist to address identified weaknesses or deficiencies
        in the security of the supply chain
      annotation: Does the organization address identified weaknesses or deficiencies
        in the security of the supply chain
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-03.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-03.4
      name: Adequate Supply
      description: Mechanisms exist to develop and implement a spare parts strategy
        to ensure that an adequate supply of critical components is available to meet
        operational needs.
      annotation: Does the organization develop and implement a spare parts strategy
        to ensure that an adequate supply of critical components is available to meet
        operational needs?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-04
      name: Third-Party Services
      description: Mechanisms exist to mitigate the risks associated with third-party
        access to the organization's systems and data.
      annotation: Does the organization mitigate the risks associated with third-party
        access to its systems and data?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-04.1
      name: Third-Party Risk Assessments & Approvals
      description: Mechanisms exist to conduct a risk assessment prior to the acquisition
        or outsourcing of technology-related services.
      annotation: Does the organization conduct a risk assessment prior to the acquisition
        or outsourcing of technology-related services?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-04.2
      name: External Connectivity Requirements - Identification of Ports, Protocols
        & Services
      description: Mechanisms exist to require External Service Providers (ESPs) to
        identify and document the business need for ports, protocols and other services
        it requires to operate its processes and technologies.
      annotation: Does the organization require External Service Providers (ESPs)
        to identify and document the business need for ports, protocols and other
        services it requires to operate its processes and technologies?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-04.3
      name: Conflict of Interests
      description: Mechanisms exist to ensure that the interests of external service
        providers are consistent with and reflect organizational interests.
      annotation: Does the organization ensure that the interests of external service
        providers are consistent with and reflect organizational interests?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-04.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-04.4
      name: Third-Party Processing, Storage and Service Locations
      description: Mechanisms exist to restrict the location of information processing/storage
        based on business requirements.
      annotation: Does the organization restrict the location of information processing/storage
        based on business requirements?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05
      name: Third-Party Contract Requirements
      description: Mechanisms exist to require contractual requirements for cybersecurity
        & data privacy requirements with third-parties, reflecting the organization's
        needs to protect its systems, processes and data.
      annotation: Does the organization require contractual requirements for cybersecurity
        & data privacy requirements with third-parties, reflecting its needs to protect
        its systems, processes and data?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.1
      name: Security Compromise Notification Agreements
      description: Mechanisms exist to compel External Service Providers (ESPs) to
        provide notification of actual or potential compromises in the supply chain
        that can potentially affect or have adversely affected systems, applications
        and/or services that the organization utilizes.
      annotation: Does the organization compel External Service Providers (ESPs) to
        provide notification of actual or potential compromises in the supply chain
        that can potentially affect or have adversely affected systems, applications
        and/or services that the organization utilizes?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.2
      name: Contract Flow-Down Requirements
      description: Mechanisms exist to ensure cybersecurity & data privacy requirements
        are included in contracts that flow-down to applicable sub-contractors and
        suppliers.
      annotation: Does the organization ensure cybersecurity & data privacy requirements
        are included in contracts that flow-down to applicable sub-contractors and
        suppliers?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.3
      name: Third-Party Authentication Practices
      description: Mechanisms exist to ensure External Service Providers (ESPs) use
        unique authentication factors for each of its customers.
      annotation: Does the organization ensure External Service Providers (ESPs) use
        unique authentication factors for each of its customers?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.4
      name: Responsible, Accountable, Supportive, Consulted & Informed (RASCI) Matrix
      description: Mechanisms exist to document and maintain a Responsible, Accountable,
        Supportive, Consulted & Informed (RASCI) matrix, or similar documentation,
        to delineate assignment for cybersecurity & data privacy controls between
        internal stakeholders and External Service Providers (ESPs).
      annotation: Does the organization document and maintain a Responsible, Accountable,
        Supportive, Consulted & Informed (RASCI) matrix, or similar documentation,
        to delineate assignment for cybersecurity & data privacy controls between
        internal stakeholders and External Service Providers (ESPs)?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.5
      name: Third-Party Scope Review
      description: Mechanisms exist to perform recurring validation of the Responsible,
        Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation,
        to ensure cybersecurity & data privacy control assignments accurately reflect
        current business practices, compliance obligations, technologies and stakeholders.
      annotation: Does the organization perform recurring validation of the Responsible,
        Accountable, Supportive, Consulted & Informed (RASCI) matrix, or similar documentation,
        to ensure cybersecurity & data privacy control assignments accurately reflect
        current business practices, compliance obligations, technologies and stakeholders?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.6
      name: First-Party Declaration (1PD)
      description: Mechanisms exist to obtain a First-Party Declaration(1PD) from
        applicable External Service Providers (ESPs) that provides assurance of compliance
        with specified statutory, regulatory and contractual obligations for cybersecurity
        & data privacy controls, including any flow-down requirements to subcontractors.
      annotation: Does the organization obtain a First-Party Declaration (1PD) from
        applicable External Service Providers (ESPs) that provides assurance of compliance
        with specified statutory, regulatory and contractual obligations for cybersecurity
        & data privacy controls, including any flow-down requirements to subcontractors?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.7
      name: Break Clauses
      description: Mechanisms exist to include "break clauses" within contracts for
        failure to meet contract criteria for cybersecurity and/or data privacy controls.
      annotation: Does the organization include "break clauses" within contracts for
        failure to meet contract criteria for cybersecurity and/or data privacy controls?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-05.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-05.8
      name: Third-Party Attestation (3PA)
      description: Mechanisms exist to obtain an attestation from an independent Third-Party
        Assessment Organization (3PAO) that provides assurance of conformity with
        specified statutory, regulatory and contractual obligations for cybersecurity
        & data privacy controls, including any flow-down requirements to contractors
        and subcontractors.
      annotation: Does the organization obtain an attestation from an independent
        Third-Party Assessment Organization (3PAO) that provides assurance of conformity
        with specified statutory, regulatory and contractual obligations for cybersecurity
        & data privacy controls, including any flow-down requirements to contractors
        and subcontractors?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-06
      name: Third-Party Personnel Security
      description: Mechanisms exist to control personnel security requirements including
        security roles and responsibilities for third-party providers.
      annotation: Does the organization control personnel security requirements including
        security roles and responsibilities for third-party providers?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-07
      name: Monitoring for Third-Party Information Disclosure
      description: Mechanisms exist to monitor for evidence of unauthorized exfiltration
        or disclosure of organizational information.
      annotation: Does the organization monitor for evidence of unauthorized exfiltration
        or disclosure of organizational information?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-08
      name: Review of Third-Party Services
      description: Mechanisms exist to monitor, regularly review and assess External
        Service Providers (ESPs) for compliance with established contractual requirements
        for cybersecurity & data privacy controls.
      annotation: Does the organization monitor, regularly review and audit External
        Service Providers (ESPs) for compliance with established contractual requirements
        for cybersecurity & data privacy controls?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-09
      name: Third-Party Deficiency Remediation
      description: Mechanisms exist to address weaknesses or deficiencies in supply
        chain elements identified during independent or organizational assessments
        of such elements.
      annotation: Does the organization address weaknesses or deficiencies in supply
        chain elements identified during independent or organizational assessments
        of such elements?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-10
      name: Managing Changes To Third-Party Services
      description: Mechanisms exist to control changes to services by suppliers, taking
        into account the criticality of business information, systems and processes
        that are in scope by the third-party.
      annotation: Does the organization control changes to services by suppliers,
        taking into account the criticality of business information, systems and processes
        that are in scope by the third-party?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:tpm
      ref_id: TPM-11
      name: Third-Party Incident Response & Recovery Capabilities
      description: Mechanisms exist to ensure response/recovery planning and testing
        are conducted with critical suppliers/providers.
      annotation: Does the organization ensure response/recovery planning and testing
        are conducted with critical suppliers/providers?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      assessable: false
      depth: 1
      ref_id: THR
      name: Threat Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-01
      name: Threat Intelligence Program
      description: Mechanisms exist to implement a threat intelligence program that
        includes a cross-organization information-sharing capability that can influence
        the development of the system and security architectures, selection of security
        solutions, monitoring, threat hunting, response and recovery activities.
      annotation: Does the organization implement a threat intelligence program that
        includes a cross-organization information-sharing capability that can influence
        the development of the system and security architectures, selection of security
        solutions, monitoring, threat hunting, response and recovery activities?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-02
      name: Indicators of Exposure (IOE)
      description: Mechanisms exist to develop Indicators of Exposure (IOE) to understand
        the potential attack vectors that attackers could use to attack the organization.
      annotation: Does the organization develop Indicators of Exposure (IOE) to understand
        the potential attack vectors that attackers could use to attack the organization?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-03
      name: Threat Intelligence Feeds
      description: Mechanisms exist to maintain situational awareness of vulnerabilities
        and evolving threats by leveraging the knowledge of attacker tactics, techniques
        and procedures to facilitate the implementation of preventative and compensating
        controls.
      annotation: Does the organization maintain situational awareness of vulnerabilities
        and evolving threats by leveraging the knowledge of attacker tactics, techniques
        and procedures to facilitate the implementation of preventative and compensating
        controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-03.1
      name: Threat Intelligence Reporting
      description: Mechanisms exist to utilize external threat intelligence feeds
        to generate and disseminate organization-specific security alerts, advisories
        and/or directives.
      annotation: Does the organization utilize external threat intelligence feeds
        to generate and disseminate organization-specific security alerts, advisories
        and/or directives?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-04
      name: Insider Threat Program
      description: Mechanisms exist to implement an insider threat program that includes
        a cross-discipline insider threat incident handling team.
      annotation: Does the organization implement an insider threat program that includes
        a cross-discipline insider threat incident handling team?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-05
      name: Insider Threat Awareness
      description: Mechanisms exist to utilize security awareness training on recognizing
        and reporting potential indicators of insider threat.
      annotation: Does the organization utilize security awareness training on recognizing
        and reporting potential indicators of insider threat?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-06
      name: Vulnerability Disclosure Program (VDP)
      description: Mechanisms exist to establish a Vulnerability Disclosure Program
        (VDP) to assist with the secure development and maintenance of products and
        services that receives unsolicited input from the public about vulnerabilities
        in organizational systems, services and processes.
      annotation: Does the organization establish a Vulnerability Disclosure Program
        (VDP) to assist with the secure development and maintenance of products and
        services that receives unsolicited input from the public about vulnerabilities
        in organizational systems, services and processes?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-06.1
      name: Security Disclosure Contact Information
      description: Mechanisms exist to enable public submissions of discovered or
        potential security vulnerabilities.
      annotation: Does the organization enable public submissions of discovered or
        potential security vulnerabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-07
      name: Threat Hunting
      description: Mechanisms exist to perform cyber threat hunting that uses Indicators
        of Compromise (IoC) to detect, track and disrupt threats that evade existing
        security controls.
      annotation: Does the organization perform cyber threat hunting that uses Indicators
        of Compromise (IoC) to detect, track and disrupt threats that evade existing
        security controls?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-08
      name: Tainting
      description: Mechanisms exist to embed false data or steganographic data in
        files to enable the organization to determine if data has been exfiltrated
        and provide a means to identify the individual(s) involved.
      annotation: Does the organization embed false data or steganographic data in
        files to enable the organization to determine if data has been exfiltrated
        and provide a means to identify the individual(s) involved?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-09
      name: Threat Catalog
      description: Mechanisms exist to develop and keep current a catalog of applicable
        internal and external threats to the organization, both natural and manmade.
      annotation: Does the organization develop and keep current a catalog of applicable
        internal and external threats to the organization, both natural and manmade?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-10
      name: Threat Analysis
      description: Mechanisms exist to identify, assess, prioritize and document the
        potential impact(s) and likelihood(s) of applicable internal and external
        threats.
      annotation: Does the organization identify, assess, prioritize and document
        the potential impact(s) and likelihood(s) of applicable internal and external
        threats?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:thr
      ref_id: THR-11
      name: Behavioral Baselining
      description: Automated mechanisms exist to establish behavioral baselines that
        capture information about user and entity behavior to enable dynamic threat
        discovery.
      annotation: Does the organization use automated mechanisms to establish behavioral
        baselines that capture information about user and entity behavior to enable
        dynamic threat discovery?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      assessable: false
      depth: 1
      ref_id: VPM
      name: Vulnerability & Patch Management
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-01
      name: Vulnerability & Patch Management Program (VPMP)
      description: Mechanisms exist to facilitate the implementation and monitoring
        of vulnerability management controls.
      annotation: Does the organization facilitate the implementation and monitoring
        of vulnerability management controls?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-01.1
      name: Attack Surface Scope
      description: Mechanisms exist to define and manage the scope for its attack
        surface management activities.
      annotation: Does the organization define and manage the scope for its attack
        surface management activities?
      implementation_groups:
      - tier1
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-02
      name: Vulnerability Remediation Process
      description: Mechanisms exist to ensure that vulnerabilities are properly identified,
        tracked and remediated.
      annotation: Does the organization ensure that vulnerabilities are properly identified,
        tracked and remediated?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-03
      name: Vulnerability Ranking
      description: Mechanisms exist to identify and assign a risk ranking to newly
        discovered security vulnerabilities using reputable outside sources for security
        vulnerability information.
      annotation: Does the organization identify and assign a risk ranking to newly
        discovered security vulnerabilities using reputable outside sources for security
        vulnerability information?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-03.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-03.1
      name: Vulnerability Exploitation Analysis
      description: Mechanisms exist to identify, assess, prioritize and document the
        potential impact(s) and likelihood(s) of applicable internal and external
        threats exploiting known vulnerabilities.
      annotation: Does the organization identify, assess, prioritize and document
        the potential impact(s) and likelihood(s) of applicable internal and external
        threats exploiting known vulnerabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-04
      name: Continuous Vulnerability Remediation Activities
      description: Mechanisms exist to address new threats and vulnerabilities on
        an ongoing basis and ensure assets are protected against known attacks.
      annotation: Does the organization address new threats and vulnerabilities on
        an ongoing basis and ensure assets are protected against known attacks?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-04.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-04.1
      name: Stable Versions
      description: Mechanisms exist to install the latest stable version of any software
        and/or security-related updates on all applicable systems.
      annotation: Does the organization install the latest stable version of any software
        and/or security-related updates on all applicable systems?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-04.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-04.2
      name: Flaw Remediation with Personal Data (PD)
      description: Mechanisms exist to identify and correct flaws related to the collection,
        usage, processing or dissemination of Personal Data (PD).
      annotation: Does the organization identify and correct flaws related to the
        collection, usage, processing or dissemination of Personal Data (PD)?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-04.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-04.3
      name: Deferred Patching Decisions
      description: Mechanisms exist to facilitate the deferral of software and/or
        firmware patches when the disadvantages of applying the patch outweighs the
        benefits.
      annotation: Does the organization facilitate the deferral of software and/or
        firmware patches when the disadvantages of applying the patch outweighs the
        benefits?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05
      name: Software & Firmware Patching
      description: Mechanisms exist to conduct software patching for all deployed
        operating systems, applications and firmware.
      annotation: Does the organization conduct software patching for all deployed
        operating systems, applications and firmware?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.1
      name: Centralized Management of Flaw Remediation Processes
      description: Mechanisms exist to centrally-manage the flaw remediation process.
      annotation: Does the organization centrally-manage the flaw remediation process?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.2
      name: Automated Remediation Status
      description: Automated mechanisms exist to determine the state of system components
        with regard to flaw remediation.
      annotation: Does the organization use automated mechanisms to determine the
        state of system components with regard to flaw remediation?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.3
      name: Time To Remediate / Benchmarks For Corrective Action
      description: Mechanisms exist to track the effectiveness of remediation operations
        through metrics reporting.
      annotation: Does the organization track the effectiveness of remediation operations
        through metrics reporting?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.4
      name: Automated Software & Firmware Updates
      description: Automated mechanisms exist to install the latest stable versions
        of security-relevant software and firmware updates.
      annotation: Does the organization use automated mechanisms to install the latest
        stable versions of security-relevant software and firmware updates?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.5
      name: Removal of Previous Versions
      description: Mechanisms exist to remove old versions of software and firmware
        components after updated versions have been installed.
      annotation: Does the organization remove old versions of software and firmware
        components after updated versions have been installed?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.6
      name: Pre-Deployment Patch Testing
      description: Mechanisms exist to perform due diligence on software and/or firmware
        update stability by conducting pre-production testing in a non-production
        environment.
      annotation: Does the organization perform due diligence on software and/or firmware
        update stability by conducting pre-production testing in a non-production
        environment?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.7
      name: Out-of-Cycle Patching
      description: Mechanisms exist to perform out-of-cycle software and/or firmware
        updates to address time-sensitive remediations.
      annotation: Does the organization perform out-of-cycle software and/or firmware
        updates to address time-sensitive remediations?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-05.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-05.8
      name: Software Patch Integrity
      description: "Mechanisms exist to ensure software and/or firmware patches are:\n\
        (1) Obtained from trusted sources; and \n(2) Checked for integrity."
      annotation: "Does the organization ensure software and/or firmware patches are:\n\
        (1) Obtained from trusted sources; and \n(2) Checked for integrity?"
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06
      name: Vulnerability Scanning
      description: Mechanisms exist to detect vulnerabilities and configuration errors
        by routine vulnerability scanning of systems and applications.
      annotation: Does the organization detect vulnerabilities and configuration errors
        by routine vulnerability scanning of systems and applications?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.1
      name: Update Tool Capability
      description: Mechanisms exist to update vulnerability scanning tools.
      annotation: Does the organization update vulnerability scanning tools?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.2
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.2
      name: Breadth / Depth of Coverage
      description: Mechanisms exist to identify the breadth and depth of coverage
        for vulnerability scanning that define the system components scanned and types
        of vulnerabilities that are checked for.
      annotation: Does the organization identify the breadth and depth of coverage
        for vulnerability scanning that define the system components scanned and types
        of vulnerabilities that are checked for?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.3
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.3
      name: Privileged Access
      description: Mechanisms exist to implement privileged access authorization for
        selected vulnerability scanning activities.
      annotation: Does the organization implement privileged access authorization
        for selected vulnerability scanning activities?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.4
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.4
      name: Trend Analysis
      description: Automated mechanisms exist to compare the results of vulnerability
        scans over time to determine trends in system vulnerabilities.
      annotation: Does the organization use automated mechanisms to compare the results
        of vulnerability scans over time to determine trends in system vulnerabilities?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.5
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.5
      name: Review Historical event logs
      description: Mechanisms exist to review historical event logs to determine if
        identified vulnerabilities have been previously exploited.
      annotation: Does the organization review historical event logs to determine
        if identified vulnerabilities have been previously exploited?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.6
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.6
      name: External Vulnerability Assessment Scans
      description: "Mechanisms exist to perform quarterly external vulnerability scans\
        \ (outside the organization's network looking inward) via a reputable vulnerability\
        \ service provider, which include rescans until passing results are obtained\
        \ or all \u201Chigh\u201D vulnerabilities are resolved, as defined by the\
        \ Common Vulnerability Scoring System (CVSS)."
      annotation: "Does the organization perform quarterly external vulnerability\
        \ scans (outside its network looking inward) via a reputable vulnerability\
        \ service provider, which include rescans until passing results are obtained\
        \ or all \u201Chigh\u201D vulnerabilities are resolved, as defined by the\
        \ Common Vulnerability Scoring System (CVSS)?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.7
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.7
      name: Internal Vulnerability Assessment Scans
      description: "Mechanisms exist to perform quarterly internal vulnerability scans,\
        \ which includes all segments of the organization's internal network, as well\
        \ as rescans until passing results are obtained or all \u201Chigh\u201D vulnerabilities\
        \ are resolved, as defined by the Common Vulnerability Scoring System (CVSS)."
      annotation: "Does the organization perform quarterly internal vulnerability\
        \ scans, which includes all segments of its internal network, as well as rescans\
        \ until passing results are obtained or all \u201Chigh\u201D vulnerabilities\
        \ are resolved, as defined by the Common Vulnerability Scoring System (CVSS)?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.8
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.8
      name: Acceptable Discoverable Information
      description: Mechanisms exist to define what information is allowed to be discoverable
        by adversaries and take corrective actions to remediated non-compliant systems.
      annotation: Does the organization define what information is allowed to be discoverable
        by adversaries and take corrective actions to remediated non-compliant systems?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-06.9
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-06.9
      name: Correlate Scanning Information
      description: Automated mechanisms exist to correlate the output from vulnerability
        scanning tools to determine the presence of multi-vulnerability/multi-hop
        attack vectors.
      annotation: Does the organization use automated mechanisms to correlate the
        output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop
        attack vectors?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-07
      name: Penetration Testing
      description: Mechanisms exist to conduct penetration testing on systems and
        web applications.
      annotation: Does the organization conduct penetration testing on systems and
        web applications?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-07.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-07.1
      name: Independent Penetration Agent or Team
      description: Mechanisms exist to utilize an independent assessor or penetration
        team to perform penetration testing.
      annotation: Does the organization utilize an independent assessor or penetration
        team to perform penetration testing?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-08
      name: Technical Surveillance Countermeasures Security
      description: Mechanisms exist to utilize a technical surveillance countermeasures
        survey.
      annotation: Does the organization utilize a technical surveillance countermeasures
        survey?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-09
      name: Reviewing Vulnerability Scanner Usage
      description: Mechanisms exist to monitor logs associated with scanning activities
        and associated administrator accounts to ensure that those activities are
        limited to the timeframes of legitimate scans.
      annotation: Does the organization monitor logs associated with scanning activities
        and associated administrator accounts to ensure that those activities are
        limited to the timeframes of legitimate scans?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:vpm
      ref_id: VPM-10
      name: Red Team Exercises
      description: Mechanisms exist to utilize "red team" exercises to simulate attempts
        by adversaries to compromise systems and applications in accordance with organization-defined
        rules of engagement.
      annotation: Does the organization utilize "red team" exercises to simulate attempts
        by adversaries to compromise systems and applications in accordance with organization-defined
        rules of engagement?
      implementation_groups:
      - tier2
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      assessable: false
      depth: 1
      ref_id: WEB
      name: Web Security
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-01
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-01
      name: Web Security
      description: Mechanisms exist to facilitate the implementation of an enterprise-wide
        web management policy, as well as associated standards, controls and procedures.
      annotation: Does the organization facilitate the implementation of an enterprise-wide
        web management policy, as well as associated standards, controls and procedures?
      implementation_groups:
      - tier1
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-01.1
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-01.1
      name: Unauthorized Code
      description: "Mechanisms exist to prevent unauthorized code from being present\
        \ in a secure page as it is rendered in a client\u2019s browser."
      annotation: "Does the organization prevent unauthorized code from being present\
        \ in a secure page as it is rendered in a client\u2019s browser?"
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-02
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-02
      name: Use of Demilitarized Zones (DMZ)
      description: Mechanisms exist to utilize a Demilitarized Zone (DMZ) to restrict
        inbound traffic to authorized devices on certain services, protocols and ports.
      annotation: Does the organization utilize a Demilitarized Zone (DMZ) to restrict
        inbound traffic to authorized devices on certain services, protocols and ports?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-03
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-03
      name: Web Application Firewall (WAF)
      description: Mechanisms exist to deploy Web Application Firewalls (WAFs) to
        provide defense-in-depth protection for application-specific threats.
      annotation: Does the organization deploy Web Application Firewalls (WAFs) to
        provide defense-in-depth protection for application-specific threats?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-04
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-04
      name: Client-Facing Web Services
      description: Mechanisms exist to deploy reasonably-expected security controls
        to protect the confidentiality and availability of client data that is stored,
        transmitted or processed by the Internet-based service.
      annotation: Does the organization deploy reasonably-expected security controls
        to protect the confidentiality and availability of client data that is stored,
        transmitted or processed by the Internet-based service?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-05
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-05
      name: Cookie Management
      description: Mechanisms exist to provide individuals with clear and precise
        information about cookies, in accordance with applicable legal requirements
        for cookie management.
      annotation: Does the organization provide individuals with clear and precise
        information about cookies, in accordance with applicable legal requirements
        for cookie management?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-06
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-06
      name: Strong Customer Authentication (SCA)
      description: Mechanisms exist to implement Strong Customer Authentication (SCA)
        for consumers to reasonably prove their identity.
      annotation: Does the organization implement Strong Customer Authentication (SCA)
        for consumers to reasonably prove their identity?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-07
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-07
      name: Web Security Standard
      description: Mechanisms exist to ensure the Open Web Application Security Project
        (OWASP) Application Security Verification Standard is incorporated into the
        organization's Secure Systems Development Lifecycle (SSDLC) process.
      annotation: Does the organization ensure the Open Web Application Security Project
        (OWASP) Application Security Verification Standard is incorporated into its
        Secure Systems Development Lifecycle (SSDLC) process?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-08
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-08
      name: Web Application Framework
      description: Mechanisms exist to ensure a robust Web Application Framework is
        used to aid in the development of secure web applications, including web services,
        web resources and web APIs.
      annotation: Does the organization ensure a robust Web Application Framework
        is used to aid in the development of secure web applications, including web
        services, web resources and web APIs?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-09
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-09
      name: Validation & Sanitization
      description: Mechanisms exist to ensure all input handled by a web application
        is validated and/or sanitized.
      annotation: Does the organization ensure all input handled by a web application
        is validated and/or sanitized?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-10
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-10
      name: Secure Web Traffic
      description: Mechanisms exist to ensure all web application content is delivered
        using cryptographic mechanisms (e.g., TLS).
      annotation: Does the organization ensure all web application content is delivered
        using cryptographic mechanisms (e.g., TLS)?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-11
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-11
      name: Output Encoding
      description: Mechanisms exist to ensure output encoding is performed on all
        content produced by a web application to reduce the likelihood of cross-site
        scripting and other injection attacks.
      annotation: Does the organization ensure output encoding is performed on all
        content produced by a web application to reduce the likelihood of cross-site
        scripting and other injection attacks?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-12
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-12
      name: Web Browser Security
      description: Mechanisms exist to ensure web applications implement Content-Security-Policy,
        HSTS and X-Frame-Options response headers to protect both the web application
        and its users.
      annotation: Does the organization ensure web applications implement Content-Security-Policy,
        HSTS and X-Frame-Options response headers to protect both the web application
        and its users?
      implementation_groups:
      - tier2
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-13
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-13
      name: Website Change Detection
      description: Mechanisms exist to detect and respond to Indicators of Compromise
        (IoC) for unauthorized alterations, additions, deletions or changes on websites
        that store, process and/or transmit sensitive / regulated data.
      annotation: Does the organization detect and respond to Indicators of Compromise
        (IoC) for unauthorized alterations, additions, deletions or changes on websites
        that store, process and/or transmit sensitive / regulated data?
      implementation_groups:
      - tier3
    - urn: urn:intuitem:risk:req_node:scf-2025.2.2:web-14
      assessable: true
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:scf-2025.2.2:web
      ref_id: WEB-14
      name: Publicly Accessible Content Reviews
      description: Mechanisms exist to routinely review the content on publicly accessible
        systems for sensitive/regulated data and remove such information, if discovered.
      annotation: Does the organization routinely review the content on publicly accessible
        systems for sensitive/regulated data and remove such information, if discovered?
      implementation_groups:
      - tier2
