A Security Engineering Capability Maturity Model

This paper presents a framework for a mature security engineering process and organization that can lead to better, cheaper, and faster development of secure systems and products. A Security Engineering Capability Maturity Model (SE CMM) is being developed to guide process improvement in the practice of security engineering. The model consists of a sequence of levels that guide a security engineering organization toward process improvement through small, incremental steps. The goal of the model is to develop an organizational culture of continuous process improvement. Development and acceptance of the SE CMM can lead to improvements in the practice of security engineering and also the production and measurement of assurance. This paper describes the concept of a SE CMM, promotes an understanding for its need and use, and states our objectives and approach for producing the model.