METHOD AND SYSTEM FOR RAPID ACCREDITATION/RE-ACCREDITATION OF AGILE IT ENVIRONMENTS, FOR EXAMPLE SERVICE ORIENTED ARCHITECTURE (SOA)

摘要

A system and method for managing and analyzing security requirements in reusable models. At least one functional model, at least one security implementation model, at least one requirement model, and meta models of the models are read by a reader. A correspondence between the functional model, security implementation model, and the requirements model is analyzed, whereby the correspondence indicates that compliance/security/accreditation requirements defined in the requirement model match with security objectives implemented by controls defined by the security implementation model. Next, it is determined whether correspondence is or is not given based on the analysis of the correspondence and then evidence is generated based on the analysis of the correspondence and the determination and the impact of changes is analyzed.

主权项

1. A method for detecting and analyzing changes to an IT system and its security, the method comprising:
reading a current or previously stored evidence version relating to the IT system; normalizing the current evidence version; storing the current evidence version; reading one or more previously stored versions of the normalized evidence; identifying differences between the read normalized evidence versions; and determining whether a change has been detected based on the identified differences between the read normalized evidence versions.