Question

- The capability levels of the SSE-CMM contain defined practices that embody common features. How do these practices underwrite capability determination? How does a lower level support a higher level?

- The SSE-CMM underwrites assessments of base practices and capability. What is the difference between these two types of assessment? Why are two types of assessment valuable?

Answer 1

I would be answering this question subpart by subpart as it asked.

- First, let us understand what SSE-CMM means. SSE-CMM in information security stands for Systems Security Engineering – Capability Maturity Model. Along with SSE-CMM, there is one more important term to know and that is ISO 15004. The most important thing about ISO 15004 is that it contains practices and principles that have been really effective as the time has passed. The SSE-CMM gives us the practical information that allows the higher-level people to evaluate the security of their software against the current business risks and needs. Also, the goal of the SME-CSS is to provide a secure environment in an organization where continuous improvement is encouraged. As a result, we can say that SME-CSS focuses on specific operations such as process assessment, process improvement and most importantly, capability determination.

- With the help of SSE-CMM, we can have a permanent solution for accessing and evaluating security capability that can apply across the entire organization. Using technology-independent measures, this method evaluates the security of system and software engineering processes. The procedure, in general, understands the relative security of a system process and then the capability of the organisation too to execute that process effectively. Hence the two types of assessment can be that this model can give us the measure of capability for an entire organization and can also measure for a specific process too. Both are valuable because we might any one type of assessment anytime.

Solution ends.

Please comment and let me know if you have any further doubts. Please upvote this answer if you like it.

Thank you.

Have a good day.