“The SSE-CMM describes the essential characteristics of an organization’s security engineering process that must exist to ensure sound security engineering. This model is something that will most definitely be covered on the CISSP examination, so make sure you study it well!

Employing this model has several benefits; its primary focal points are the following:

• Tool for engineering organizations to evaluate security engineering practices and define improvements to them
• Standards mechanism for customers to evaluate a provider’s security engineering capability
• Basis for security engineering evaluation organization (system certifiers and product evaluators) to establish organization capability-based confidences (as an ingredient to system or project security assurance)”

In addition to this the maturity model addresses Continuity, Repeatability, Efficiency, and Assurance

So what exactly is the SSE-CCM? Well, it’s a process reference model which focuses on the requirements for implementing security across systems in the Information Technology Security Domain.  The SSE-CMM has a relationship to the ISO/IEC TR 15504 standard (particularly ISO/IEC TR 15504-2)

Practices

Within the SSE-CCM there are several Generic Practices, these are considered applicable for to all processes. The generic practices are used in a process appraisal to determine the capability of any process. These practices are grouped according to common feature and capability level.

Capability Level 1 – Performed Informally
Capability Level 2 – Planned and Tracked
Capability Level 3 – Well Defined
Capability Level 4 – Quantitatively Controlled
Capability Level 5 – Continuously Improving

More Information: http://www.sse-cmm.org/docs/ssecmmv3final.pdf