The Capability Maturity Model and Its Linkage to the Overarching Architecture

1. The Capability Maturity Model and Its Linkage to the Overarching Architecture June 2, 2006 Dr Tom Buckman NC3A Chief Architect Leader IPT1 - Architecture NATO / EAPC UNCLASSIFIED

2. The Brief Covers • Basic CMM Concepts / Initial Focus • OA Features Supporting Development and Use of CMM • Focus for utilization of CMM NATO / EAPC UNCLASSIFIED

3. User Missions Operations Mang- ement Ser- vices Functional Services Information Integration Services Sec- urity Ser- vices Communication Services NNEC CMM Concept and The Overarching Architecture (OA) • NNEC CMM inspired by work of Carnegie Mellon, Software Engineering Institute (SEI) • Initial SEI work focused on software development processes • SEI work characterized by a five-level model describing an evolutionary path for achieving a ‘goal’ • NNEC CMM concept • Focus is on Services • Involves: • Five-level model • Areas identified in the NNECStrategic Framework • Overarching Architecture providesdescriptions of Service needsand dependencies NATO / EAPC UNCLASSIFIED

4. TOA TOA TOA TOA TOA TOA Mange-ment & Control Services Users Missions Operations Functional Services Security Services Information Integration Services Communication Services Governance Initial Focus – NII CMM • Four Service Areas • Service Taxonomy • Service Areas • Service Groups • Service Categories • Enterprise Services • Maturity Levels • Represent major improvements in capabilities within a Service Area • Reflect technology and architectural trends • Driven by Operational Needs • Services identified from the perspective of ‘users’ • Actors / Service components external to a Service Area NATO / EAPC UNCLASSIFIED

5. OA Features Supporting CMM -Initial Listing of NII Services • OA v2.5 provides an initial (partial) listing ofNII Enterprise Services • Services are based on results of theNNEC Feasibility Study (NNEC FS) • Includes services identified in the NATO C3 Technical Architecture • Reflects work on technology trends done by the Gartner Group and the Forrester Group • Services are • Identified by Areas : Groups : Categories • Linked to Transformational Phases • Service groupings provide starting point for identifying CMM Levels NATO / EAPC UNCLASSIFIED

6. Information Security ServiceManagementControl IIS Core Services layer Discovery Personal Communication Storage Application Conferencing Mediation Personal efficiency Audio service Service Provisioning service Service Runtime Environment service Storage service Information assurance User assistance Service Publisher service Streaming Audio service Application service Information service Information subscriber service Information Catalogue service Video service Mail service Centralized storage service Text service Mail service Fax gateway service Video Gateway service Voice service Information Publisher service Centralized Storage service Mail Gateway service Instant Messaging service Distributed storage service Telex Gateway service Streaming Video service Notifier service Reporting service Information Integration Reporting service Notifier service IIS Infrastructure layer Information structure Access Operating system Structured Information Exchange Unstructured Information Exchange Structured Storage service Network access service Structured Storage service Report Generator service Incident Notifier service Video based service Translator service Audio based service Translator service Service subscriber service Service Catalogue service Video based Conferencing service Storage service Audio based Conferencing service Service runtime service Enterprise Service management Remote access service Robust Runtime Environment service Dial-in Access service Roaming User service Event Notifier service MIP Translator service Storage access service User workspace Manager service User workspace manager service Storage Management Provider service Whiteboard service Text service Text Conferencing service Whiteboard Conferencing service Portal service Portal service Browser service Device independent Console service Network layer Information Objectenvironment service Help support service Helpsupport service Security Network Management Core IP External networks Application service Service Installer service Network Management service Console service Online Help service Service Uninstaller service Personal productivity service Personal productivity service Tutorial service Communication Transport layer Unstructured Storage service Distributed Storage service Unstructured Storage service Context-sensitive Help service Transmission Radio QoS Communication Archiving service Security management service Confidentiality service Encryption service Confidentiality service Public/Private Key service Encryption service Security Management service Key Management service Certificate Management service Certificate service Availability service Integrity service Non-repudiation service Integrity service Availability service Cross-domani Sharing service Non- repudiation service Plug and Operate service Intrusion Detection service Biometric Authentication service DigitalSignature service Chip Authentication service Password Authentication service Real-time Information Exchange service Near real-time Information Exchange service File based exchange service Non-secure Information transport service Non-secure Information transport service MILS Environment service MILS service File transfer service Malicious Code Detection service Time Stamping service Information object Framework service Proxy service Secure Information Transport service Secure Information Transport service Information Object service Document Framework service Web service WAN service LAN Access service Directory service File Based P2P service COBIT/ITIL service Management info service Web Access service Asset Management service Authentication service Management Info publisher service Strong Authentication service User Management service Object Labelling service Property Labelling service Auditing service Near real-time Information Exchange service Property Based P2P service Replication Gateway service Non-secure Information Transfer service Auditing service Robust Runtime service Management Info collector service Management Info subscriber service Meta-data repository service Message Gateway service Meta-data service Business rules service Secure Information Transfer service Management Info provider service Ontology Repository service Management InfoExchange service Security service External Networks service IP service IP Broadcas servicet IP Multicast service IP Unicast service Performance Parameter Exchange service Service Class Mapping service Service Class Concatenation service Tunneling service IP Gateway service Crypto compoment IPv6 service IP Anycast IPv4 service IPx -> IPy service Border Protection service Border Protection service Satellite service QoS service Wireless Broadband service Fixed service Radio service GSM service Optical Wireless Transmission service Satellite service Fixed service VHF Radio service UHF Radio service QoS Management service UWB service MBWA service Working Example –Catalogue of NII Services from OAv2.5 NATO / EAPC UNCLASSIFIED

7. OA Features Supporting CMM –Association of Services with Systems • The OA provides for inclusion of information on current and planned systems • Focus is on NATO Common Funded Systems • Includes information on potential Enterprise Services to be provided by systems • This feature means that the OA can be used to assess ability of systems to support a CMM level • Current system information limited to systems with published Reference Architectures • Includes information on planned use of ‘Infrastructure’ Services NATO / EAPC UNCLASSIFIED

8. Association of Services with Systems –Sample View from Current OA NATO / EAPC UNCLASSIFIED

9. OA Features Supporting CMM -Operation Needs Linked To NII Services • The OA contains models of the ‘mission space’ and associated ‘user’ information requirements • Information requirements are linked to requirements for Functional and Infrastructure Services • As a result OA can be used to formally identify NII Services required to support transformational maturity levels Do Better Things! Do Things Better! NATO / EAPC UNCLASSIFIED

10. Utilization of CMM • NII related, CP and Force planning • Broad statement of requirements for NII • Common language to sync NATO, national efforts • Starting point for reference level architecture work • Supports identification of requiredinteroperability services • Starting point for identifying changes to existing programs • Basis for development of NII certification criteria • Quality of Information (QoI) driven by mission objectives, linked to Quality of Service (QoS) constraints • Constraints provide basis for development of metrics, which can be used in developing criteria NATO / EAPC UNCLASSIFIED

11. Summary • OA provides an architectural foundation to support CMM development • Initial listing of NII Services • Linking of operational needs to required NII Services • Alignment of Services Across Service Areas • OA can be used to map CMM levels to systems • Limited information on current and planned systems available in OAv2.5 • OA can support development of CMM certification criteria • Criteria would be linked to Quality of Information and Quality of Service constraints • Constraints would be based on operational needs NATO / EAPC UNCLASSIFIED

12. NC3A Brussels Visiting address: Bâtiment ZAvenue du Bourget 140B-1110 BrusselsTelephone +32 (0)2 7074111Fax +32 (0)2 7078770 Postal address:NATO C3 AgencyBoulevard Leopold IIIB-1110 Brussels - Belgium NC3A The Hague Visiting address: Oude Waalsdorperweg 612597 AK The HagueTelephone +31 (0)70 3743000Fax +31 (0)70 3743239 Postal address:NATO C3 AgencyP.O. Box 1742501 CD The HagueThe Netherlands CONTACTING NC3A NATO / EAPC UNCLASSIFIED