Apr 18, 2020
How Control Maturity Impacts Your Information Security Compliance
Control maturity has always been key to proactive risk management; it's the difference between identifying a risk before it happens vs. handling the fallout. Organizations that have effective controls are still finding it difficult to identify problems before they occur, often relying on reactive processes and dealing with challenges as they emerge.
In contrast, organizations that have implemented a control maturity program are more proactive at mitigating risk and responding to changes. In this article, we will explore why control maturity matters, how control maturity models can be used, and the implications maturity has for business performance.
Why Control Maturity Matters
Control maturity is an effective way of measuring the efficiency and risk of an organization's security controls. Control maturity enables organizations to identify strengths and weakness within their compliance program.
Proactively identifying gaps in an information security program, subsequently enables CISO's and Compliance Managers to align company priorities. In doing so, organizations have all the information they need to allocate an appropriate budget and dedicate resources. Tracking control maturity drives proactive thinking and opens discussions around risk management.
Control Maturity Models
CMMI is the leading industry standard control maturity model used by information security teams. In this article we will be focusing on CMMI, but it is important to know that alternatives exist and have their own pro and cons.
Alternative models have been developed such as the Portfolio, Program and Project Management Maturity model (P3M3) for project management, the Quality Maturity Model for quality management, and the CERT Resilience Management model for information technology. Unlike these models, CMMI can be applied to an entire organization.
CMMI - A Brief History
Capability Maturity Model (CMM) was initially developed for the US government to assess software vendors. This model established principles of measuring control maturity and assigning ratings based on progressive levels of performance. CMM was then expanded into the Capability Maturity Model Integration (CMMI) framework. CMMI is a process level improvement and training program that guides performance improvement across projects, divisions, or entire organizations.
Benefits of CMMI
There are significant benefits to Implementing a model like CMMI. CMMI's maturity measurement gives a deep insight into performance and identifies priorities for improvement. CMMI provides a framework for process improvement which leads to improved quality, decreased costs and enhanced productivity, increased customer satisfaction and improved on-time delivery.
Measuring Control Maturity
Most control models measure control maturity and assign scores based on a short performance scale. The CMMI's stages of maturity, and characteristics are:
Level 0: Incomplete - adhoc and unknown.
Work may or may not get completed.
Level 1: Initial - unpredictable and reactive.
Work gets completed but is often delayed and over budget.
Level 2: Managed - managed on the project level.
Projects are planned. Performed and controlled
Level 3: Defined - proactive rather than reactive.
Organization-wide standards provide guidance across projects, programs and portfolios.
Level 4: Quantitatively Managed - measured and controlled.
Organization is data-driven with quantitative performance improvement objectives that are predictable and align to meet the needs of internal and external stakeholders.
Level 5: Optimizing - stable and flexible.
Organization is focused on continuous improvement and is built to pivot and respond to opportunity and change. The organization's stability provides a platform for agility and innovation
The CMMI is continually updated and is used by many leading businesses around the world today.
GRC Software With Built-in CMMI
Achieving control maturity can be challenging but it can be made easier with software.
Your Governance, risk and compliance (GRC) tool should have control maturity tracking, measuring and reporting built in. Ideally leveraging your existing tools to track control maturity will save you time and strengthen your companies risk posture.
There are significant benefits to using a dedicated software platform instead of documenting your compliance program in an ad hoc manner. Dedicated platforms that include control maturity models enable companies to standardize and centralize processes and information, saving time and resources. Other advantages included easily managing compliance to multiple standards including; ISO, SOC, NIST, HIPAA, GDPR, PCI-DSS, FedRAMP and more.
GRC tools can be used to effectively measure and improve maturity as your compliance program evolves. Tracking of control maturity is an important aspect that drives proactive thinking and opens discussions around risk management. A complete GRC platform that uses the industry recognized CMMI control maturity model is ideally the optimal solution. Regardless if you have a dedicated GRC tool or not measuring control maturity is a key driving factor of any forward-thinking information security team today.
