Simone Petrella, CEO of CyberVista – which certifies many of the Defense Department’s security personnel – approves of the approach taken by the Cybersecurity Maturity Model Certification, but warns that if the program’s designers don’t take time to spell out specific requirements, things could all fall apart.
The plan is to have independent auditors overseen by a nonprofit accreditation body use the model in conjunction with assessment guides to certify whether contracting applicants have the “maturity” of security needed to protect the data they would be handling. Petrella says those guides need to flesh out what proof is needed to demonstrate conformity with a certain level of maturity, so the auditors know what to look for.