SOMA - Security Operations Maturity Architecture

SOMA (Security Operations Maturity Architecture) offers a new approach to defining security operations and management processes. Originally designed to fill the need for a simple and widely applicable quality standard for ISM systems, SOMA provides a framework for easily structuring and accurately measuring operational security and management process.

As a maturity model, SOMA provides an architecture model applicable at any security maturity level of any size organization. SOMA can be applied cleanly with high sophistication to assure business objectives are specifically tailored to security design, implementation, operations, management, procurement, and assurance processes.

SOMA is both logical and comprehensive for organizations already using standards such as COBIT, ITIL, CMMI, ISO17799, ISO27001, OCTAVE, and the OSSTMM. It is structured into maturity levels based on operational security metrics so that organizations can choose an appropriate level for their business and move in stages towards it.

This project's goals are to maximize ability for roll-out and to defy antiquating itself while allowing to certify under a specific security maturity level. As technology and process studies provide greater insight to business with each passing year, it has become important for ISECOM methodologies to avoid the necessity of product-based methods, traditional risk analysis which requires constant upkeep of threat assessment, vulnerability assessment, and asset values, and best practices which are not specific to the organization applying it.

For those looking for a security maturity model, need a certifiable security management process, or require a comprehensible method for structuring security processes, the SOMA project will provide the answer.

For those looking for ISM3:

The ISECOM ISM3 maturity model (Information Security Management Maturity Model) has been expanded into SOMA. This name change and project re-structuring will provide an improved approach to security management maturity. Converging technologies and processes, current ISM systems are no longer simply classifiable as ISM. Due to the inherent limitations imposed within ISM3, the maturity model is being broadened to apply to operations and reach beyond information security.

If you are interested in helping with this project please contact us.