Security Governance on Bill Brown:Thoughts and Reference Material Onlinehttps://www.billbrown.info/tags/security-governance/Recent content in Security Governance on Bill Brown:Thoughts and Reference Material OnlineHugo -- gohugo.ioenBillBrown.infoSat, 08 Aug 2026 00:00:00 +0000Applying ISA-CMM Process Areas to Capability Appraisalshttps://www.billbrown.info/post/applying-isa-cmm-process-areas-to-capability-appraisals/Sat, 08 Aug 2026 00:00:00 +0000https://www.billbrown.info/post/applying-isa-cmm-process-areas-to-capability-appraisals/ <h2 id="applying-isa-cmm-process-areas-to-capability-appraisals">Applying ISA-CMM Process Areas to Capability Appraisals</h2> <p>A maturity model only produces a usable result if the appraisal method built around it is disciplined. ISSC662 coursework on the Information Security Assurance Capability Maturity Model (ISA-CMM) treats the appraisal itself as the object worth studying, not just the security controls the model eventually recommends. A source review can catalog what a maturity model measures. An appraisal has to decide how that measurement gets collected, checked, and reported back to the organization being assessed.</p>