IAO-01: Information Assurance (IA) Operations

There is no evidence of a capability to facilitate the implementation of cybersecurity and data protection assessment and authorization controls.

Information Assurance (IA) is ad hoc and inconsistent. CMM Level 1 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• Pre-production security testing is decentralized.
• IT personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/ or contractual requirements for pre-production cybersecurity and data protection control testing.

Information Assurance (IA) is requirements-driven and governed at a local/regional level, but not consistently across the enterprise. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
• IT/cybersecurity personnel identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for pre-production cybersecurity and data protection control testing.
• IT personnel implement and maintain an established a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/ or contractual requirements for pre-production cybersecurity and data protection control testing.
• IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
• Business process owners (BPOs) are made aware of cybersecurity and data protection risk(s).
• IAP controls are primarily administrative in nature (e.g., policies & standards) to manage technical controls for cybersecurity and data protection requirements.
• IAP testing results in a formal risk assessment where BPOs are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/ or (4) accept risk(s) on behalf of the organization.

Information Assurance (IAO) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• The Chief Information Security Officer (CISO), or similar function with technical competence to address cybersecurity concerns, analyzes the organization's business strategy to determine prioritized and authoritative guidance for Information Assurance (IA) practices.
• The CISO, or similar function, develops a security-focused Concept of Operations (CONOPS) that documents management, operational and technical measures to apply defense-in-depth techniques across the enterprise for IA.
• A Governance, Risk & Compliance (GRC) function, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and data protection controls to protect the confidentiality, integrity, availability and safety of the organization's applications, systems, services and data with regards to IA.
• A steering committee is formally established to provide executive oversight of the cybersecurity and data protection program, including IA.
• Cybersecurity personnel implement and maintain an established Information Assurance Program (IAP) capability to conduct “business as usual” pre-production cybersecurity and data protection control testing focused on the concept of “security and data protection be design and by default.”
• The IAP validates that systems/applications/services/processes are both secure and compliant.
• A Project Management Office (PMO), or project management function, ensures project involvement for IAP as part of the organization's established project management processes.
• A Plan of Action and Milestones (POA&M) or similar mechanism, exists to document planned remediation actions to correct weaknesses or deficiencies noted during the assessment of the security controls, helping to reduce or eliminate known vulnerabilities.
• Administrative processes prevent systems/applications/services/processes from “going live” in a production environment without first going through the IAP process.
• The IAP uses a tiered approach to conformity testing, based on (1) the sensitivity of data that is stored, processed and/ or transmitted and (2) the criticality of the system/application/service/process.
• Business Process Owners (BPOs) are made aware of cybersecurity and data protection risk(s).
• IAP controls are primarily administrative in nature (e.g., policies & standards) to manage technical controls for cybersecurity and data protection requirements.
• IAP testing results in a formal risk assessment where BPOs are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/ or (4) accept risk(s) on behalf of the organization.

Information Assurance (IA) is metrics driven and provides sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
• Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
• Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
• Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
• Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
• Both business and technical stakeholders are involved in the review process for proposed changes.

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to facilitate the implementation of cybersecurity and data protection assessment and authorization controls.