IAO-02.4: Security Assessment Report (SAR)

There is no evidence of a capability to produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.

C|P-CMM1 is N/A, since a structured process is required to produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.

Information Assurance (IA) is requirements-driven and governed at a local/regional level, but not consistently across the enterprise. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
• IT/cybersecurity personnel identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for pre-production cybersecurity and data privacy control testing.
• IT personnel implement and maintain an established a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/ or contractual requirements for pre-production cybersecurity and data privacy control testing.
• IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.
• Business process owners (BPOs) are made aware of cybersecurity and data privacy risk(s).
• IAP testing results in a formal risk assessment where BPOs are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/ or (4) accept risk(s) on behalf of the organization.

Information Assurance (IA) is standardized across the enterprise and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:

• Cybersecurity personnel implement and maintain an established Information Assurance Program (IAP) capability to conduct “business as usual” pre-production cybersecurity and data privacy control testing focused on the concept of “security and data privacy be design and by default.”
• The IAP validates that systems/applications/services/processes are both secure and compliant.
• A Governance, Risk & Compliance (GRC) function, or similar function, facilitates the implementation of cybersecurity and data protection controls to ensure that secure engineering practices are designed and implemented throughout the lifecycle of systems, applications and services both internal and external to the organization.
• A Project Management Office (PMO), or project management function, ensures project involvement for IAP as part of the organization's established project management processes.
• A Plan of Action and Milestones (POA&M) or similar mechanism, exists to document planned remediation actions to correct weaknesses or deficiencies noted during the assessment of the security controls, helping to reduce or eliminate known vulnerabilities.
• Administrative processes prevent systems/applications/services/processes from “going live” in a production environment without first going through the IAP process.
• The IAP uses a tiered approach to conformity testing, based on (1) the sensitivity of data that is stored, processed and/ or transmitted and (2) the criticality of the system/application/service/process.
• IAP controls are primarily administrative in nature (e.g., policies & standards) to manage technical controls for cybersecurity and data privacy.
• IAP testing results in a formal risk assessment where BPOs are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/ or (4) accept risk(s) on behalf of the organization.
• Business Process Owners (BPOs) are made aware of cybersecurity and data privacy risk(s).
• IAP testing results in a formal risk assessment where BPOs are required to make a decision to (1) reduce, (2) avoid, (3) transfer and/ or (4) accept risk(s) on behalf of the organization.

See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to produce a Security Assessment Report (SAR) at the conclusion of a security assessment to certify the results of the assessment and assist with any remediation actions.