ISO/IEC 21827

ISO/IEC 21827:2002(E)
6.4 Summary Chart
This chart represents the model at a high level of abstraction. The practitioner is cautioned that each process area
consists of a number of base practices, which are described in detail in Clause 7 and Annex B. Also, each common
feature consists of a number of generic practices, which are described in detail in Annex A.
5.2 Improving Proc. Effectiveness
5.1 Improving Org. Capability
4.2 Objectively Managing Perf.
4.1 Establish Meas. Quality Goals
3.3 Coordinate Practices
3.2 Perform the Defined Process
3.1 Defining a Standard Process
2.4 Tracking Performance
2.3 Verifying Performance
2.2 Disciplined Performance
2.1 Planned Performance
1.1 Base Practices Are Performed
Common
Features
Process
Areas
PA01 – Administer Security Controls
PA02 – Assess Impact
PA03 – Assess Security Risk
PA04 – Assess Threat
PA05 – Assess Vulnerability
PA06 – Build Assurance Argument
PA07 – Coordinate Security
PA08 – Monitor Security Posture
PA09 – Provide Security Input
PA10 – Specify Security Needs
PA11 – Verify and Validate Security
PA12 – Ensure Quality
PA13 – Manage Configuration
PA14 – Manage Project Risk
PA15 – Monitor and Control Technical Ef
PA16 – Plan Technical Effort
PA17 – Define Org. Systems Eng. Proce
PA18 – Improve Org. Systems Eng. Proc
PA19 – Manage Product Line Evolution
PA20 – Manage Systems Eng. Support E
PA21 – Provide Ongoing Skills and Knldg
PA22 – Coordinate with Suppliers
Security Engineering
Process Areas
Project and Organizational
Process Areas
Figure 7 - Summary of Process Areas and Common Features relationships
7 Security Base Practices
This clause contains the base practices, that is, the practices considered essential to the conduct of basic security
engineering. Note that the process areas are numbered in no particular order since the SSE-CMM® does not prescribe
a specific process or sequence.
An organization can be assessed against any one single process area or combination of process areas. The process
areas together, however, are intended to cover all base practices for security engineering and there are many
inter-relationships between the process areas. At present, the SSE-CMM® comprises 11 security process areas, each
20 © ISO/IEC 2002 – All rights reserved