A Practical Approach to Improving and Communicating Assurance

Assurance in the security of rapidly evolving enterprises depends on a complex set of evidence. This paper describes a method for structuring this body of evidence into a manageable framework called an “assurance argument.” The method is extremely flexible, and is capable of including all relevant claims and evidence. The structure allows the practitioner to compare the costs and benefits of different assurance approaches, to keep track of the rationale for each piece of evidence, and to identify areas where additional evidence is indicated. Further, the approach is modular and allows assurance to be communicated and reused efficiently. Ultimately, assurance arguments enable a better understanding of all the factors that go into creating assurance. This understanding, in turn, plays a major role in the intelligent management of risk. A PRACTICAL APPROACH TO IMPROVING AND COMMUNICATING ASSURANCE 1 A PRACTICAL APPROACH TO IMPROVING AND COMMUNICATING ASSURANCE