Library / BCR

BCR

Business Continuity Management and Operational Resilience

Domain definition — mapping in progress (source: AI Controls Matrix (AICM) Introductory Guidance).

Control objectives

Skills

Cross-cutting

—

Objectives fitted

AISMM maturity context

Infrastructure Security and Resilience · Structural domain

L1 InitialL2 RepeatableL3 DefinedL4 CapableL5 Efficient

A lens, not a partition. How AISMM adoption works →

Control objectives

The exact things this domain must do. Each carries an authoritative crosswalk to 9 external control sets (Cloud Security Alliance (CSA) AI Controls Matrix (AICM) v1.1.0). Fitted skills are drawn from the pool below as fits are evidenced.

Business Continuity Management Policy and ProceduresBCR-01

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 12 steps

Cloud Service Provider — 7 steps

Application Provider — 4 steps

Model Provider — 4 steps

Orchestrated Services Provider — 4 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Risk Assessment and Impact AnalysisBCR-02

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 6 steps

Application Provider — 4 steps

Model Provider — 4 steps

Orchestrated Services Provider — 4 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Business Continuity StrategyBCR-03

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 9 steps

Application Provider — 6 steps

Model Provider — 6 steps

Orchestrated Services Provider — 7 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Business Continuity PlanningBCR-04

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 10 steps

Application Provider — 7 steps

Model Provider — 7 steps

Orchestrated Services Provider — 7 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

DocumentationBCR-05

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 11 steps

Application Provider — 7 steps

Model Provider — 7 steps

Orchestrated Services Provider — 7 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Business Continuity ExercisesBCR-06

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 4 steps

Cloud Service Provider — 11 steps

Application Provider — 9 steps

Model Provider — 8 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

CommunicationBCR-07

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 6 steps

Cloud Service Provider — 12 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 11 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

BackupBCR-08

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 12 steps

Application Provider — 12 steps

Model Provider — 12 steps

Orchestrated Services Provider — 12 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Disaster Response PlanBCR-09

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 12 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 11 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Response Plan ExerciseBCR-10

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 5 steps

Cloud Service Provider — 11 steps

Application Provider — 11 steps

Model Provider — 11 steps

Orchestrated Services Provider — 11 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Equipment RedundancyBCR-11

Crosswalk

ISO/IEC 42001EU AI ActBSI AIC4CCM v4.0.13AICPA TSC 2017ISO/IEC 27001:2022ISO/IEC 27002:2022NIST 800-53 rev 5NIST CSF v2.0

Implementation & auditing guidance

Shared implementation — 7 steps

Cloud Service Provider — 13 steps

Application Provider — 10 steps

Model Provider — 10 steps

Orchestrated Services Provider — 10 steps

Verbatim Cloud Security Alliance (CSA) implementation & auditing steps are available to the owner.

Fitted skill — mapping in progress. Candidates are drawn from this domain’s skill pool below.

Standard names and gap levels shown; the specific clause references and full control text are available to the owner.

Skill pool — BCR

Running AI Safety Incident Response For Harmful Behavior

The other AICM domains

A&AAudit & Assurance AISApplication & Interface Security CCCChange Control and Configuration Management CEKCryptography, Encryption & Key Management DCSDatacenter Security DSPData Security and Privacy Lifecycle Management GRCGovernance, Risk and Compliance HRSHuman Resources IAMIdentity & Access Management IPYInteroperability & Portability I&SInfrastructure Security LOGLogging and Monitoring MDSModel Security SEFSecurity Incident Management, E-Discovery, & Cloud Forensics STASupply Chain Management, Transparency, and Accountability TVMThreat & Vulnerability Management UEMUniversal Endpoint Management

Assess a function on this domain →See how a fit gets deployed