ISO/IEC 21827:2002
(Main)Information technology — Systems Security Engineering — Capability Maturity Model (SSE-CMM®)
Information technology — Systems Security Engineering — Capability Maturity Model (SSE-CMM®)
Technologies de l'information — Ingénierie de sécurité système — Modèle de maturité de capacité (SSE-CMM®)
General Information
Relations
Standards Content (Sample)
INTERNATIONAL ISO/IEC
STANDARD 21827
First edition
2002-10-01
Information technology — Systems
Security Engineering — Capability Maturity
Model (SSE-CMM)
Technologies de l'information — Ingénierie de sécurité système — Modèle
de maturité de capacité (SSE-CMM)
Reference number
ISO/IEC 21827:2002(E)
©
ISO/IEC 2002
---------------------- Page: 1 ----------------------
ISO/IEC 21827:2002(E)
PDF disclaimer
This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not
be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this
file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this
area.
Adobe is a trademark of Adobe Systems Incorporated.
Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters
were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event
that a problem relating to it is found, please inform the Central Secretariat at the address given below.
© ISO/IEC 2002
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic
or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body
in the country of the requester.
ISO copyright office
Case postale 56 • CH-1211 Geneva 20
Tel. + 41 22 749 01 11
Fax + 41 22 749 09 47
E-mail copyright@iso.ch
Web www.iso.ch
Printed in Switzerland
ii © ISO/IEC 2002 – All rights reserved
---------------------- Page: 2 ----------------------
ISO/IEC 21827:2002(E)
Contents
Foreword . v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 2
4 Background . 5
4.1 Reason for Development . 5
4.2 The Importance of Security Engineering . 6
4.3 Consensus . 6
5 Structure of the Document . 7
6 Model Architecture . 7
6.1 Security Engineering . 7
6.2 Security Engineering Process Overview . 9
6.3 SSE-CMM® Architecture Description . 12
6.4 Summary Chart . 20
7. Security Base Practices . 20
7.1 PA01 - Administer Security Controls . 21
7.2 PA02 - Assess Impact . 24
7.3 PA03 - Assess Security Risk . 28
7.4 PA04 - Assess Threat . 31
7.5 PA05 - Assess Vulnerability . 34
7.6 PA06 - Build Assurance Argument . 37
7.7 PA07 - Coordinate Security . 40
7.8 PA08 - Monitor Security Posture . 42
7.9 PA09 - Provide Security Input . 47
7.10PA10 - Specify Security Needs . 50
7.11PA11 - Verify and Validate Security . 54
Annex A(normative)Generic Practices . 57
A.1 General . 57
A.2 Capability Level 1 - Performed Informally . 57
A.3 Capability Level 2 - Planned and Tracked . 58
A.4 Capability Level 3 - Well Defined . 63
A.5 Capability Level 4 - Quantitatively Controlled . 68
A.6 Capability Level 5 - Continuously Improving . 70
© ISO/IEC 2002 – All rights reserved iii
---------------------- Page: 3 ----------------------
ISO/IEC 21827:2002(E)
Annex B(normative)Project and Organizational Base Practices . 73
B.1 General . 73
B.2 General Security Considerations . 73
B.3 PA12 - Ensure Quality . 73
B.4 PA13 - Manage Configurations . 78
B.5 PA14 - Manage Project Risks . 81
B.6 PA15 - Monitor and Control Technical Effort . 85
B.7 PA16 - Plan Technical Effort . 88
B.8 PA17 - Define Organization's Systems Engineering Process . 93
B.9 PA18 - Improve Organization's Systems Engineering Processes . 96
B.10 PA19 - Manage Product Line Evolution . 99
B.11 PA20 - Manage Systems Engineering Support Environment . 101
B.12 PA21 - Provide Ongoing Skills and Knowledge . 105
B.13 PA22 - Coordinate with Suppliers . 110
Annex C(informative)Capability Maturity Model Concepts . 114
C.1 General . 114
C.2 Process Improvement . 114
C.3 Expected Results . 115
C.4 Common Misunderstandings . 115
C.5 Key Concepts . 116
Bibliography . 120
iv © ISO/IEC 2002 – All rights reserved
---------------------- Page: 4 ----------------------
ISO/IEC 21827:2002(E)
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission)
form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC
participate in the development of International Standards through technical committees established by the
respective organization to deal with particular fields of technical activity. ISO and IEC technical committees
collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in
liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have
established a joint technical committee, ISO/IEC JTC 1.
International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 3.
The main task of the joint technical committee is to prepare International Standards. Draft International Standards
adopted by the joint technical committee are circulated to national bodies for voting. Publication as an Internationa
Standard requires approval by at least 75 % of the national bodies casting a vote.
Attention is drawn to the possibility that some of the elements of this International Standard may be the subject of
patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.
ISO/IEC 21827 was prepared by the International Systems Security Engineering Association (ISSEA) (formerly the
1)
Systems Security Engineering — Capability Maturity Model Project) and was adopted, under the PAS
procedure, by Joint Technical Committee ISO/IEC JTC 1, Information technology, in parallel with its approval by
national bodies of ISO and IEC.
Annexes A and B form a normative part of this International Standard. Annex C is for information only.
_________________________
1) CMM and Capability Maturity Model are Service Marks of Carnegie Mellon University
Not-for-profit corporation
5000 Forbes Avenue, Pittsburgh, PA 15213
© ISO/IEC 2002 – All rights reserved v
---------------------- Page: 5 ----------------------
ISO/IEC 21827:2002(E)
Introduction
A wide variety of organizations practice security engineering in the development of computer programs, whether as
operating systems software, security managing and enforcing functions, software, middleware of applications programs.
Appropriate methods and practices are therefore required by product developers, service providers, system integrators,
system administrators, and even security specialists. Some of these organizations deal with high-level issues (e.g.,
ones dealing with operational use or system architecture), others focus on low-level issues (e.g., mechanism selection
or design), and some do both. Organizations may specialize in a particular type of technology, or a specialized context
(e.g. at sea).
The SSE-CMM® is designed for all these organizations. Use of the SSE-CMM should not imply that one focus is better
than another is or that any of these uses are required. An organization's business focus need not be biassed by use of
the SSE-CMM®.
Based on the focus of the organization, some, but not all, of the security engineering practices defined will apply. In
addition, the organization may need to look at relationships between different practices within the model to determine
their applicability. The examples below illustrate ways in which the SSE-CMM® may be applied to software, systems,
facilities development and operation by a variety of different organizations.
Security Service Providers
To measure the process capability of an organization that performs risk assessments, several groups of practices come
into play. During system development or integration, one would need to assess the organization with regard to its ability
to determine and analyze security vulnerabilities and assess the operational impacts. In the operational case, one would
need to assess the organization with regard to its ability to monitor the security posture of the system, identify and
analyze security vulnerabilities, and assess the operational impacts.
Countermeasure Developers
In the case of a group that focuses on the development of countermeasures, the process capability of an organization
would be characterized by a combination of SSE-CMM® practices. The model contains practices to address
determining and analyzing security vulnerabilities, assessing operational impacts, and providing input and guidance to
other groups involved (such as a software group). The group that provides the service of developing countermeasures
needs to understand the relationships between these practices.
Product Developers
The SSE-CMM® includes practices that focus on gaining an understanding of the customer's security needs. Interaction
with the customer is required to ascertain them. In the case of a product, the customer is generic as the product is
developed a priori independent of a specific customer. When this is the case, the product marketing group or another
group can be used as the hypothetical customer, if one is required.
Practitioners in security engineering recognize that the product contexts and the methods used to accomplish product
development are as varied as the products themselves. However, there are some issues related to product and project
context that are known to have an impact on the way products are conceived, produced, delivered, and maintained. The
following issues in particular have significance for the SSE-CMM®:
• Type of customer base (products, systems, or services);
• Assurance requirements (high vs. low);
• Support for both development and operational organizations.
The differences between two diverse customer bases, differing degrees of assurance requirements, and the impacts of
each of these differences in the SSE-CMM® are discussed below. These are provided as an example of how an
organization or industry segment might determine appropriate use of the SSE-CMM® in their environment.
vi © ISO/IEC 2002 – All rights reserved
---------------------- Page: 6 ----------------------
ISO/IEC 21827:2002(E)
Specific Industry Segments
Every industry reflects its own particular culture, terminology, and communication style. By minimizing the role
dependencies and organization structure implications, it is anticipated that the SSE-CMM® concepts can be easily
translated by all industry segments into their own language and culture.
How Should the SSE-CMM® Be Used?
The SSE-CMM® and the method for applying the model (i.e., appraisal method) are intended to be used as a:
• Tool for engineering organizations to evaluate their security engineering practices and define improvements;
• Method by which security engineering evaluation organizations such as certifiers and evaluators can establish
confidence in the organizational capability as one input to system or product security assurance;
• Standard mechanism for customers to evaluate a provider's security engineering capability.
The appraisal techniques can be used in applying the model for self improvement and in selecting suppliers, if the users
of the model and appraisal methods thoroughly understand the proper application of the model and its inherent
limitations. Additional information on using process assessment can be found in ISO/IEC CD 15504-4 Software
Engineering — Process Assessment — Part 4: Guidance on use for Process Improvement and Process Capability
Determination.
Benefits of Using the SSE-CMM®
The trend for security is a shift from protecting classified government data to a broader spectrum of concerns including
financial transactions, contractual agreements, personal information, and the Internet. A corresponding proliferation of
products, systems, and services that maintain and protect information has emerged. These security products and
systems typically come to market in one of two ways: through lengthy and expensive evaluation or without evaluation. In
the former case, trusted products often reach the market long after their features are needed and secure systems are
being deployed that no longer address current threats. In the latter, acquirers and users must rely solely on the security
claims of the product or system developer or operator. Further, security engineering services traditionally were often
marketed on this caveat emptor basis.
This situation calls for organizations to practice security engineering in a more mature manner. Specifically, the
following qualities are needed in the production and operation of secure systems and trusted products:
• Continuity - knowledge acquired in previous efforts is used in future efforts;
• Repeatability - a way to ensure that projects can repeat a successful effort;
• Efficiency - a way to help both developers and evaluators work more efficiently;
• Assurance - confidence that security needs are being addressed.
To provide for these requirements, a mechanism is needed to guide organizations in understanding and improving their
security engineering practices. To address these needs, the SSE-CMM® is being developed to advance the state of the
practice of security engineering with the goal of improving the quality and availability of and reducing the cost of
delivering secure systems, trusted products, and security engineering services. In particular, the following benefits are
envisioned:
To Engineering Organizations:
Engineering organizations include System Integrators, Application Developers, Product Vendors, and Service
Providers. Benefits of the SSE-CMM® to these organizations include:
• Savings with less rework from repeatable, predictable processes and practices;
• Credit for true capability to perform, particularly in source selections;
• Focus on measured organizational competency (maturity) and improvements.
To Acquiring Organizations:
Acquirers include organizations acquiring systems, products, and services from external/internal sources and end
users. Benefits of the SSE-CMM® to these organizations include:
• Reusable standard Request for Proposal language and evaluation means;
• Reduced risks (performance, cost, schedule) of choosing an unqualified bidder;
• Fewer protests due to uniform assessments based on industry standard;
• Predictable, repeatable level of confidence in product or service.
© ISO/IEC 2002 – All rights reserved vii
---------------------- Page: 7 ----------------------
ISO/IEC 21827:2002(E)
To Evaluation Organizations:
Evaluation organizations include System Certifies, System Accreditors, Product Evaluators, and Product Assessors.
Benefits of the SSE-CMM® to these organizations include:
• Reusable process appraisal results, independent of system or product changes;
• Confidence in security engineering and its integration with other disciplines;
• Capability-based confidence in evidence, reducing security evaluation workload.
viii © ISO/IEC 2002 – All rights reserved
---------------------- Page: 8 ----------------------
INTERNATIONAL STANDARD ISO/IEC 21827:2002(E)
Information technology — Systems Security Engineering —
Capability Maturity Model (SSE-CMM)
1 Scope
The SSE-CMM® is a process reference model. It is focussed upon the requirements for implementing security in a
system or series of related systems that are the ITS domain. Within the ITS domain the SSE-CMM® Model is
focussed on the processes used to achieve ITS, most specifically on the maturity of those processes. There is no intent
within the SSE-CMM® Model to dictate a specific process to be used by an organization, let alone a specific
methodology. Rather the intent is that the organization making use of the SSE-CMM® Model should use its existing
processes, be those processes based upon any other ITS guidance document. The scope encompasses:
• the system security engineering activities for a secure product or a trusted system addressing the complete
lifecycle of: concept definition, requirements analysis, design, development, integration, installation, operation,
maintenance end de-commissioning;
• requirements for product developers, secure systems developers and integrators, organizations that provide
computer security services and computer security engineering;
• applies to all types and sizes of security engineering organizations from commercial to government and the
academe.
While the SSE-CMM® is a distinct model to improve and assess security engineering capability, this should not imply
that security engineering should be practised in isolation from other engineering disciplines. On the contrary, the
SSE-CMM® promotes such integration, taking the view that security is pervasive across all engineering disciplines
(e.g., systems, software and hardware) and defining components of the model to address such concerns. The Common
Feature "Coordinate Security Practices" recognizes the need to integrate security with all disciplines and groups
involved on a project or within an organization. Similarly, the Process Area "Coordinate Security" defines the objectives
and mechanisms to be used in coordinating the security engineering activities.
This International Standard has a relationship to TR 15504, particularly part 2, as both are concerned with process
improvement and capability maturity assessment. However, TR 15504 is specifically focussed on software processes,
whereas the SSE-CMM is focussed on security.
This International Standard has a closer relationship with the new versions of 15504, particularly CD 15504-2, and is
compatible with its approaches and requirements.
2 Normative references
The following normative documents contain provisions which, through reference in this text, constitute provisions
of this International Standard. For dated references, subsequent amendments to, or revisions of, any of these
publications do not apply. However, parties to agreements based on this International Standard are encouraged to
investigate the possibility of applying the most recent editions of the normative documents indicated below. For undated
references, the latest edition of the normative document referred to applies. Members of ISO and IEC maintain registers
of currently valid International Standards.
ISO/IEC 12207, Information technology — Software life cycle processes
ISO/IEC TR 13335-1, Information technology — Guidelines for the management of IT Security — Part 1: Concepts and
models for IT Security
ISO/IEC 15288, Systems engineering — System life cycle processes
© ISO/IEC 2002 – All rights reserved 1
---------------------- Page: 9 ----------------------
ISO/IEC 21827:2002(E)
ISO/IEC TR 15504-2, Information technology — Software process assessment — Part 2: A reference model for
processes and process capability
ISO/IEC TR 15504-4, Information technology — Software process assessment — Part 4: Guide to performing
assessments
ISO/IEC 17799: 2000, Information technology — Code of practice for information security management
3 Terms and definitions
For the purposes of this International Standard, the following terms and definitions apply.
3.1 Accountability
The property that ensures that the actions of an entity can be traced uniquely to the entity. [ISO 7498-2:1988]
3.2 Accreditation
In the context of this document: formal declaration by a designated approving authority that a system is approved to
operate in a particular security mode using a prescribed set of safeguards.
Note: This definition is generally accepted within the security community; within ISO the more generally used definition
is: Procedure by which an authoritative body gives formal recognition that a body or person is competent to carry out
specific tasks. [ISO/IEC Guide 2].
3.3 Assessment
Verification of a product, system, or service against a standard using the corresponding assessment method to
establish compliance and determine the assurance. [ISO/IEC 15443-1].
3.4 Asset
Anything that has value to the organization [ISO 13335-1:1996].
3.5 Assurance
In the context of this document: Grounds for confidence that a deliverable meets its security objectives. [ISO/IEC
15408–1] .
Note: This definition is generally accepted within the security community; within ISO the more generally used definition
is: Activity resulting in a statement giving confidence that a product, process or service fulfills specified requirements.
[ISO/IEC Guide 2]
3.6 Assurance Argument
A set of structured assurance claims, supported by evidence and reasoning, that demonstrate clearly how assurance
needs have been satisfied.
3.7 Assurance Claim
An assertion or supporting assertion that a system meets a security need. Claims address both direct threats (e.g.,
system data are protected from attacks by outsiders) and indirect threats (e.g., system code has minimal flaws).
3.8 Assurance Evidence
Data on which a judgment or conclusion about an assurance claim may be based. The evidence may consist of
observation, test results, analysis results and appraisals.
3.9 Authenticity
The property that ensures that the identity of a subject or resource is the one claimed. Authenticity applies to entities
such as users, processes, systems and information. [ISO 13335-1:1996].
3.10 Availability
The property of being accessible and useable upon demand by an authorized entity. [ISO 7498-2: 1988].
2 © ISO/IEC 2002 – All rights reserved
---------------------- Page: 10 ----------------------
ISO/IEC 21827:2002(E)
3.11 Baseline
A specification or product that has been formally reviewed and agreed upon, that thereafter serves as the basis for
further development, and that can be changed only through formal change control procedures. [IEEE-STD-610].
3.12 Certification
In the context of this document, the process producing written results of performing a comprehensive evaluation of
security features and other safeguards of a system to establish the extent to which the design and implementation meet
a set of specified security requirements.
Note: This definition is generally accepted within the security community; within ISO the more generally used definition
is: Procedure by which a third party gives written assurance that a product, process or service conforms to specified
requirements. [ISO/IEC Guide 2]
3.13 Confidentiality
The property that information is not made available or disclosed to unauthorized individuals, entities, or processes
[ISO 7498-2:1988].
3.14 Consistency
The degree of uniformity, standardization, and freedom from contradiction among the documents or parts of a system or
component. [IEEE-STD-610].
3.15 Correctness
For specified security requirements, the representation of a product or system that shows the implementation of the
requirement is correct.
3.16 Customer
Recipient of a product provided by the supplier.
NOTE 1: In a contractual situation, the customer is called the purchaser.
NOTE 2: The customer may be, for example, the ultimate consumer, user, beneficiary or purchaser.
NOTE 3: The customer can be either external or internal to the organization. [ISO 8402] [ISO/IEC TR 15504]
3.17 E
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.