SSE-CMM Process Areas in Project and Organizational Practices
Question
Which of the following process areas does the SSE-CMM define in the 'Project and Organizational Practices' category? Each correct answer represents a complete solution.
Choose all that apply.
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.ACD.
Project and Organizational Practices include the following process areas: PA12: Ensure Quality PA13: Manage Configuration PA14: Manage Project Risk PA15: Monitor and Control Technical Effort PA16: Plan Technical Effort PA17: Define Organization's System Engineering Process PA18: Improve Organization's System Engineering Process PA19: Manage Product Line Evolution PA20: Manage Systems Engineering Support Environment PA21: Provide Ongoing Skills and Knowledge PA22: Coordinate with Suppliers.
The Software Security Engineering Capability Maturity Model (SSE-CMM) is a framework that defines the maturity of an organization's software security engineering processes. The SSE-CMM identifies five categories of process areas, namely:
- Security Engineering Principles
- Risk Management
- Project and Organizational Practices
- Technical Practices
- Security Management Practices
The Project and Organizational Practices category of the SSE-CMM contains process areas that focus on project management and organizational practices related to software security. This category has four process areas, which are:
A. Provide Ongoing Skills and Knowledge: This process area is concerned with ensuring that personnel involved in software development are equipped with the necessary skills and knowledge to carry out their security-related roles effectively. The organization should provide training, education, and other resources to ensure that personnel have the necessary expertise and are up to date with the latest security practices.
B. Verify and Validate Security: This process area is concerned with verifying and validating that security requirements are incorporated into the software development process. This includes the use of testing, analysis, and other methods to ensure that the software is secure and meets security requirements.
C. Manage Project Risk: This process area is concerned with identifying, analyzing, and managing risks related to software security in the project. This includes developing risk management plans, assessing risks, and implementing risk mitigation strategies.
D. Improve Organization's System Engineering Process: This process area is concerned with improving the organization's software engineering process by integrating security practices into the process. This includes defining and improving the software development process, defining security requirements, and ensuring that security is considered throughout the software development lifecycle.
In summary, the SSE-CMM defines four process areas in the Project and Organizational Practices category, which are: Provide Ongoing Skills and Knowledge, Verify and Validate Security, Manage Project Risk, and Improve Organization's System Engineering Process.
