SOC-CMM Certification Scheme v2.4

Certification
1

We are currently working on a SOC-CMM certification scheme update to align it with the assessment model (v2.4). The current scheme is still based on assessment model v2.3.

The following major changes are expected:

  • Add automation engineering to the scheme
  • Add log management to the scheme
  • Remove duplicate controls and reorder some controls
  • Mapping controls to ISO27k

What other specific controls or elements would you like to see added, updated, or removed from the scheme?

1 Like
2

Rob,

IMO, we should try and map the certification Scheme with ISO 20000 ( IT Service Management) Controls. This will be slightly more difficult as compared to 27001 controls but will be well worth it . In short ISO 20000 controls combine the requirements of ISO 9001 ( quality), 27001 ( security) and 22301 ( business continuity) for a IT centric organisation such as a SOC. In addition, aspects such as Change Management, Vendor Management, Cost and Budget Management, Customer satisfaction are covered by 20K which is in SOC CMM but not fully covered by 27K or 22301. However considerable efforts are needed for this. Thanks

3

Thank you for the input. I am not familiar with ISO20k myself, so I will look at it. THe reason for choosing ISO27k is that it is a security certification that many organisations already have, so that re-use of evidence becomes more transparant. I am aware that many organisations also have a ISO9001 certification. Do you know if ISO20k is also a common certification for MSSPs?

4

Rob,

It is not a common certification as it is somewhat difficult to implement and get certified. origin of the certification is from ITIL. Notwithstanding all these, when you go in for mapping it will be advisable to map against that standard. 27001 is only about security and does not have anything to do with customer satisfaction, budgeting , cost etc which IMO are important aspects of SOC CMM. Easier path is to take all the Appendix A controls of 27001 and map it with SOC CMM-which an AI can do. Lets see what copilot says about this

Among all ISO standards, ISO/IEC 20000‑1 (IT Service Management) is the closest and most natural mapping to SOC‑CMM. In fact, it is far superior to ISO 27001 for SOC‑CMM alignment.

SOC‑CMM has many controls that simply do not map to ISO 27001.

SOC‑CMM is a maturity model.
ISO 20000 is built around process maturity and continual improvement.

ISO 27001 is binary:
You are either compliant or not.

This makes ISO 20000 a better philosophical match.

ISO 20000 is the strongest, most accurate, and most defensible mapping for SOC‑CMM.
It aligns with SOC‑CMM’s operational, service‑delivery, and maturity‑based nature far better than ISO 27001 or any other ISO standard.

This is the same conclusion reached by many certification bodies when assessing hybrid SOCs.

Hope this clarifies

Thanks

Ramani

5

Hi Ramani,

Thanks for the additional information. I will look into it.

Regards,
Rob.