Previous

Page - 3

The framework comprises of Risk, Security, Engineering and Assurance. It also includes organizational and project oriented process areas. Like any other CMM, it also has five capability levels and an established appraisal methodology.

The SSE-CMM model addresses security-engineering activities that span the entire trusted product or secure system life-cycle, including concept definition, requirements analysis, design, development, integrations, installations, operations and maintenance. It is a generic-model which can be adapted as per industry needs. Say, for instance, within the IT domain, the model focuses on the processes and the maturity of those processes to achieve enhanced performance.

Process improvement is a continuous process and SSE-CMM provides repeatable processes that are measurable to provide a level of confidence in meeting security requirements and providing assurance.

Process Improvement & the Mature Organization

To truly appreciate the SSE- CMM model, one must understand the difference between "a process" and "a defined, documented and repeatable process". It is the later which brings in consistency across the organization service. Process repeatability brings the process under statistical control, thus, aiding in identifying areas where improvements can be made.

A mature organization strives to establish proper channels of inter- and intra-group co-ordination and communication. The practices are consistent with the processes and the processes are updated and improved upon as necessary. A mature organization focuses on process institutionalization. Reinforcing the organizational infrastructure and the supporting corporate culture that supports the methods, procedures, etc., such that they become second nature to all, even after those who originally defined them are gone. As maturity increases, costs decrease, development time shortens, productivity and quality increase. Process change management becomes an easier job in mature organizations.

How do we Integrate it?

The SSE-CMM implements process improvement through the IDEAL Model. The IDEAL model includes the following steps: -

Next

Subhashini Acharya,
Bachelor of Engineering in Computer Science from Utkal University,
Post Graduate Diploma in Management from XIM, Bhubaneswar (Batch 2006-08),
Currently, employed with TATA Corporate HR as a part of their HRDP Program.