The Secure Controls Framework (SCF) release 2023.2 contains completely new content for its Security & Privacy Capability Maturity Model (SP-CMM). This effort was conducted to help streamline and standardize maturity criteria. If you are unfamiliar with the SP-CMM, it has been around for about 4 years and is a component that is built into the SCF. The SP-CMM draws upon the high-level structure of the Systems Security Engineering Capability Maturity Model v2.0 (SSE-CMM).

The SP-CMM’s control-level maturity criteria are designed so that each succeeding level of maturity is built upon its predecessor. Essentially, you cannot run without first learning how to walk. Likewise, you cannot walk without first learning how to crawl. This approach to defining cybersecurity & privacy control maturity is how the SP-CMM is structured.

Maturity Model Use Cases

The SP-CMM is meant to solve the problem of objectivity in both establishing and evaluating cybersecurity and privacy controls. There are four (4) main objectives for the SP-CMM:

1. Provide CISO/CPOs/CIOs with objective criteria that can be used to establish expectations for a cybersecurity & privacy program;
2. Provide objective criteria for project teams so that secure practices are appropriately planned and budgeted for; and
3. Provide minimum criteria that can be used to evaluate third-party service provider controls.
4. Provide a means to perform due diligence of cybersecurity and privacy practices as part of Mergers & Acquisitions (M&A).

Divining A Maturity Level Decision From Control-Level Maturity Criteria

Do you need to answer “yes” to every bullet pointed criteria under a level of maturity in the SP-CMM? No. We recognize that every organization is different. Therefore, the maturity criteria items associated with SCF controls are to help establish what would reasonably exist for each level of maturity. Fundamentally, the decision comes down to assessor experience, professional competence and common sense.

The following two (2) questions should be kept in mind when evaluating the maturity of a control or Assessment Objective (AO):

1. Do I have reasonable evidence to defend my analysis/decision?
2. If there was an incident and I was deposed in a legal setting, can I justify my analysis/decision without perjuring myself?

Maturity (Governance) ≠ Assurance (Security)

While a more mature implementation of controls can equate to an increased level of security, higher maturity and higher assurance are not mutually inclusive. From a practical perspective, maturity is simply a measure of governance activities pertaining to a specific control or set of controls. Maturity does not equate to an in-depth analysis of the strength and depth of the control being evaluated (e.g., rigor).

According to NIST, assurance is “grounds for confidence that the set of intended security controls in an information system are effective in their application.”[1] Increased rigor in control testing is what leads to increased assurance. Therefore, increased rigor and increased assurance are mutually inclusive.

The SCF Conformity Assessment Program (SCF CAP) leverages (3) three levels of rigor. The SCF CAP’s levels of rigor utilize maturity-based criteria to evaluate a control, since a maturity target can provide context for “what right looks like” at a particular organization:

• Level 1 (Basic) - Basic assessments provide a level of understanding of the security measures necessary for determining whether the safeguards are implemented and free of obvious errors.

• Level 2 (Focused) - Focused assessments provide a level of understanding of the security measures necessary for determining whether the safeguards are implemented and free of obvious / apparent errors and whether there are increased grounds for confidence that the safeguards are implemented correctly and operating as intended.

• Level 3 (Comprehensive) - Comprehensive assessments provide a level of understanding of the security measures necessary for determining whether the safeguards are implemented and free of obvious errors and whether there are further increased grounds for confidence that the safeguards are implemented correctly and operating as intended on an ongoing and consistent basis and that there is support for continuous improvement in the effectiveness of the safeguards.

Defining SP-CMM Levels

SP-CMM Level 0 (L0) - Not Performed

This level of maturity is defined as “non-existence practices,” where the control is not being performed:

• Practices are non-existent, where a reasonable person would conclude the control is not being performed.

• Evidence of due care[2] and due diligence[3] do not exist to demonstrate compliance with applicable statutory, regulatory and/or contractual obligations.

L0 practices, or a lack thereof, are generally considered to be negligent. The reason for this is if a control is reasonably-expected to exist, by not performing the control that is negligent behavior. The need for the control could be due to a law, regulation or contractual obligation (e.g., client contract or industry association requirement).

SP-CMM Level 1 (L1) - Performed Informally

This level of maturity is defined as “ad hoc practices,” where the control is being performed, but lacks completeness & consistency:

• Practices are “ad hoc” where the intent of a control is not met due to a lack consistency and formality.

• When the control is met, it lacks consistency and formality (e.g., rudimentary practices are performed informally).

• A reasonable person would conclude the control is not consistently performed in a structured manner.

• Performance depends on specific knowledge and effort of the individual performing the task(s), where the performance of these practices is not proactively governed.

• Limited evidence of due care and due diligence exists, where it would be difficult to legitimately disprove a claim of negligence for how cybersecurity/privacy controls are implemented and maintained.

L1 practices are generally considered to be negligent. The reason for this is if a control is reasonably-expected to exist, by only implementing ad-hoc practices in performing the control that could be considered negligent behavior. The need for the control could be due to a law, regulation or contractual obligation (e.g., client contract or industry association requirement).

SP-CMM Level 2 (L2) - Planned & Tracked

Practices are “requirements-driven” where the intent of control is met in some circumstances, but not standardized across the entire organization:

• Practices are “requirements-driven” (e.g., specified by a law, regulation or contractual obligation) and are tailored to meet those specific compliance obligations (e.g., evidence of due diligence).

• Performance of a control is planned and tracked according to specified procedures and work products conform to specified standards (e.g., evidence of due care).

• Controls are implemented in some, but not all applicable circumstances/environments (e.g., specific enclaves, facilities or locations).

• A reasonable person would conclude controls are “compliance-focused” to meet a specific obligation, since the practices are applied at a local/regional level and are not standardized practices across the enterprise.

• Sufficient evidence of due care and due diligence exists to demonstrate compliance with specific statutory, regulatory and/or contractual obligations.

L2 practices are generally considered to be “audit ready” with an acceptable level of evidence to demonstrate due diligence and due care in the execution of the control. L2 practices are generally targeted on specific systems, networks, applications or processes that require the control to be performed for a compliance need (e.g., PCI DSS, HIPAA, CMMC, NIST 800-171, etc.). It can be argued that L2 practices focus more on compliance over security. The reason for this is the scoping of L2 practices are narrowly-focused and are not enterprise-wide.

SP-CMM Level 3 (L3) - Well Defined

This level of maturity is defined as “enterprise-wide standardization,” where the practices are well-defined and standardized across the organization:

• Practices are standardized “enterprise-wide” where the control is well-defined and standardized across the entire enterprise.

• Controls are implemented in all applicable circumstances/environments (deviations are documented and justified).

• Practices are performed according to a well-defined process using approved, tailored versions of standardized processes.

• Performance of a control is according to specified well-defined and standardized procedures.

• Control execution is planned and managed using an enterprise-wide, standardized methodology.

• A reasonable person would conclude controls are “security-focused” that address both mandatory and discretionary requirements. Compliance could reasonably be viewed as a “natural byproduct” of secure practices.

• Sufficient evidence of due care and due diligence exists to demonstrate compliance with specific statutory, regulatory and/or contractual obligations.

• The Chief Information Security Officer (CISO) , or similar function, develops a security-focused Concept of Operations (CONOPS) that documents organization-wide management, operational and technical measures to apply defense-in-depth techniques (note - in this context, a CONOPS is a verbal or graphic statement of intent and assumptions regarding operationalizing the identified tasks to achieve the CISO’s stated objectives. The result of the CONOPS is operating the organization’s cybersecurity and data protection program so that it meets business objectives). Control or domain-specific CONOPS may be incorporated as part of a broader operational plan for the cybersecurity and privacy program (e.g., cybersecurity-specific business plan).

L3 practices are generally considered to be “audit ready” with an acceptable level of evidence to demonstrate due diligence and due care in the execution of the control. Unlike L2 practices that are narrowly focused, L3 practices are standardized across the organization. It can be argued that L3 practices focus on security over compliance, where compliance is a natural byproduct of those secure practices. These are well-defined and properly-scoped practices that span the organization, regardless of the department or geographic considerations.

SP-CMM Level 4 (L4) - Quantitatively Controlled

This level of maturity is defined as “metrics-driven practices,” where in addition to being well-defined and standardized practices across the organization, there are detailed metrics to enable governance oversight:

• Practices are “metrics-driven” and provide sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations, and identify areas for improvement.

• Practices build upon established L3 maturity criteria and have detailed metrics to enable governance oversight.

• Detailed measures of performance are collected and analyzed. This leads to a quantitative understanding of process capability and an improved ability to predict performance.

• Performance is objectively managed, and the quality of work products is quantitatively known.

L4 practices are generally considered to be “audit ready” with an acceptable level of evidence to demonstrate due diligence and due care in the execution of the control, as well as detailed metrics enable an objective oversight function. Metrics may be daily, weekly, monthly, quarterly, etc.

SP-CMM Level 5 (L5) - Continuously Improving

This level of maturity is defined as “world-class practices,” where the practices are not only well-defined and standardized across the organization, as well as having detailed metrics, but the process is continuously improving:

• Practices are “world-class” capabilities that leverage predictive analysis.

• Practices build upon established L4 maturity criteria and are time-sensitive to support operational efficiency, which likely includes automated actions through machine learning or Artificial Intelligence (AI).

• Quantitative performance goals (targets) for process effectiveness and efficiency are established, based on the business goals of the organization.

• Process improvements are implemented according to “continuous improvement” practices to affect process changes.

L5 practices are generally considered to be “audit ready” with an acceptable level of evidence to demonstrate due diligence and due care in the execution of the control and incorporates a capability to continuously improve the process. Interestingly, this is where Artificial Intelligence (AI) and Machine Learning (ML) would exist, since AI/ML would focus on evaluating performance and making continuous adjustments to improve the process. However, AI/ML are not required to be L5.