Cloud Native Assurance Maturity Model (CNAMM)

Our Mission

Our mission is to provide organizations with an effective and measurable way to evaluate and enhance their Cloud Native security posture. We aim to enable organizations to confidently design, deploy, and operate secure Cloud Native systems through a self-assessment model that drives continuous improvement.

Overview

The Cloud Native Assurance Maturity Model (CNAMM) is a framework designed to help organizations measure and improve their Cloud Native security and assurance capabilities. This toolkit provides a structured approach to assess your organization's current maturity level and identify areas for improvement.

Framework Structure

CNAMM evaluates eight critical business functions, each containing three Practice Areas with two assessment Streams:

Business Functions

1. Strategy and Risk Governance
2. Supply Chain and Vendor Security
3. Infrastructure and Platform Security
4. Application and Data Protection
5. Identity and Access Governance
6. Runtime Security Operations
7. Threat Detection and Response
8. Resilience and Service Assurance

Assessment Streams

• Stream A (Core): Essential capabilities and security controls
• Stream B (Advanced): Advanced capabilities and innovative practices

Scoring System

Raw Scores

• 1.0: Foundation - Basic security controls and initial processes
• 1.1-2.0: Standardized - Consistent security practices and documentation
• 2.1-3.0: Optimized - Efficient processes and automation
• 3.1-3.5: Leading - Advanced capabilities and proactive security
• 3.6-4.0: Transformative - Innovative practices and industry leadership

Weighted Scores

Your organization's context affects your target security maturity level through a profile multiplier (0.9-1.2x) based on:

• Industry Requirements
• Regulatory Obligations
• Organizational Scale
• Cloud Native Maturity

Assessment Toolkit Features

Scorecard Overview

• Overall Maturity Score and Level
• Assessment Completion Status
• Business Function Scoring Summary
• Comprehensive Visualizations

Repository Contents

This repository contains essential tools and documentation for implementing CNAMM:

• CNAMM Assessment Toolkit.xlsx: Interactive assessment tool with comprehensive scoring system
• Documentation: Detailed guide covering framework fundamentals and implementation
• Graphics: Visual representations of the framework components

Getting Started

1. Download the Assessment Toolkit

   • Open CNAMM Assessment Toolkit.xlsx
   • Navigate to the Intro tab

2. Complete Organization Profile

   • Define your context
   • Understand your target maturity

3. Conduct Assessment

   • Evaluate each business function
   • Document evidence
   • Review scores and insights

4. Plan Improvements

   • Identify gaps
   • Prioritize enhancements
   • Track progress

Contributing

We welcome community contributions to improve CNAMM:

• Share your results through our Industry Benchmark Survey
• Submit improvements via pull requests
• Provide feedback and suggestions

Support

For questions or support:

• Email: [email protected]
• Submit issues through GitHub
• Join community discussions

Created By

• Abdel Sy Fane - CTO of DevSecFlow and Co-Founder and Executive Director of CyberSecurity NonProfit (CSNP)
• Francis Ofungwu - CEO of DevSecFlow

License

This work is licensed under the Creative Commons Attribution-Share Alike 4.0 License. To view a copy of this license, visit http://creativecommons.org/licenses/by-sa/4.0/legalcode

---

© 2024 DevSecFlow Community. All Rights Reserved.