• There are no items in your cart

BS ISO/IEC 21827:2008



The latest, up-to-date edition.

Information technology. Security techniques. Systems security engineering. Capability maturity model (SSE- CMM)

Available format(s)

Hardcopy , PDF



Published date


0 Introduction
1 Scope
2 Normative references
3 Terms and definitions
4 Background
  4.1 Reason for Development
  4.2 The Importance of Security Engineering
  4.3 Consensus
5 Structure of the Document
6 Model Architecture
  6.1 Security Engineering
  6.2 Security Engineering Process Overview
  6.3 SSE-CMM Architecture Description
  6.4 Summary Chart
7 Security Base Practices
  7.1 PA01 Administer Security Controls
  7.2 PA02 - Assess Impact
  7.3 PA03 - Assess Security Risk
  7.4 PA04 - Assess Threat
  7.5 PA05 - Assess Vulnerability
  7.6 PA06 - Build Assurance Argument
  7.7 PA07 - Coordinate Security
  7.8 PA08 - Monitor Security Posture
  7.9 PA09 - Provide Security Input
  7.10 PA10 - Specify Security Needs
  7.11 PA11 - Verify and Validate Security
Annex A (normative) - Generic Practices
Annex B (normative) - Project and Organizational
                      Base Practices
      B.1 General
      B.2 General Security Considerations
      B.3 PA12 - Ensure Quality
      B.4 PA13 - Manage Configurations
      B.5 PA14 - Manage Project Risks
      B.6 PA15 - Monitor and Control Technical Effort
      B.7 PA16 - Plan Technical Effort
      B.8 PA17 - Define Organization's Systems
           Engineering Process
      B.9 PA18 - Improve Organization's Systems
           Engineering Processes
      B.10 PA19 - Manage Product Line Evolution
      B.11 PA20 - Manage Systems Engineering
           Support Environment
      B.12 PA21 - Provide Ongoing Skills and
      B.13 PA22 - Coordinate with Suppliers
Annex C (informative) - Capability Maturity Model
      C.1 General
      C.2 Process Improvement
      C.3 Expected Results
      C.4 Common Misunderstandings
      C.5 Key Concepts
Annex D (informative) - Generic Practices
      D.1 General
      D.2 Capability Level 1 - Performed Informally
      D.3 Capability Level 2 - Planned and Tracked
      D.4 Capability Level 3 - Well Defined
      D.5 Capability Level 4 - Quantitatively Controlled
      D.6 Capability Level 5 - Continuously Improving

Describes the Systems Security Engineering - Capability Maturity Model (SSE-CMM).

Supersedes 06/30143284 DC. (03/2009)
British Standards Institution

This International Standard specifies the Systems Security Engineering - Capability Maturity Model® (SSE-CMM®). The SSE-CMM® is a process reference model focused upon the requirements for implementing security in a system or series of related systems that are the information technology security (ITS) domain. Within the ITS domain, the SSE-CMM® is focused on the processes used to achieve ITS, most specifically on the maturity of those processes. There is no intent within the SSE-CMM® to dictate a specific process to be used by an organization, let alone a specific methodology. Rather the intent is that the organization making use of the SSE-CMM® should use its existing processes, be those processes based upon any other ITS guidance document. The scope encompasses:

  • the system security engineering activities for a secure product or a trusted system addressing the complete life cycle of concept definition, requirements analysis, design, development, integration, installation, operation, maintenance and de-commissioning;

  • requirements for product developers, secure systems developers and integrators, organizations that provide computer security services and computer security engineering; and

  • all types and sizes of security engineering organization, from commercial to government and the academe.

While the SSE-CMM® is a distinct model to improve and assess security engineering capability, this does not imply that security engineering should be practised in isolation from other engineering disciplines. On the contrary, the SSE-CMM® promotes integration, taking the view that security is pervasive across all engineering disciplines (e.g., systems, software and hardware) and defining components of the model to address such concerns. The Common Feature “Coordinate Practices” recognizes the need to integrate security with all disciplines and groups involved on a project or within an organization. Similarly, the Process Area “Coordinate Security” defines the objectives and mechanisms to be used in coordinating the security engineering activities.

Standards Relationship
ISO/IEC 21827:2008 Identical

ISO/IEC TR 15443-1:2012 Information technology Security techniques Security assurance framework Part 1: Introduction and concepts
ISO/IEC TR 14516:2002 Information technology Security techniques Guidelines for the use and management of Trusted Third Party services
ISO/IEC 15504-4:2004 Information technology Process assessment Part 4: Guidance on use for process improvement and process capability determination
ISO/IEC 27004:2016 Information technology — Security techniques — Information security management — Monitoring, measurement, analysis and evaluation
ISO/IEC 15504-2:2003 Information technology Process assessment Part 2: Performing an assessment
ISO 7498-2:1989 Information processing systems Open Systems Interconnection Basic Reference Model Part 2: Security Architecture
ISO/IEC 15288:2008 Systems and software engineering System life cycle processes
ISO/IEC Guide 73:2002 Risk management Vocabulary Guidelines for use in standards
ISO/IEC 12207:2008 Systems and software engineering Software life cycle processes
ISO/IEC 17799:2005 Information technology Security techniques Code of practice for information security management
ISO 9001:2015 Quality management systems — Requirements
ISO/IEC Guide 2:2004 Standardization and related activities General vocabulary
ISO/IEC 15504-1:2004 Information technology Process assessment Part 1: Concepts and vocabulary
ISO/IEC 11770-1:2010 Information technology Security techniques Key management Part 1: Framework
ISO 9000-3:1997 Quality management and quality assurance standards Part 3: Guidelines for the application of ISO 9001:1994 to the development, supply, installation and maintenance of computer software

View more information
Excluding VAT

Access your standards online with a subscription


  • Simple online access to standards, technical information and regulations.

  • Critical updates of standards and customisable alerts and notifications.

  • Multi-user online standards collection: secure, flexible and cost effective.