Leveraging an existing SSP

Paramify's Recommendation​

Your organization likely spent a boatload of money already creating an SSP. This is why some Paramify users who already have ATO packages hesitate to adopt our Solution Capability platform.

And yes, Paramify will still improve and simplify your organization’s SSP creation and management processes without Solution Capabilities. But, you’ll get the most accurate OSCAL SSPs and reduce your daily headache significantly when you adopt Solution Capabilities.

Your previous efforts are not a sunk cost when you adopt Solution Capabilities. We can use your existing SSP to create custom Solution Capabilities to meet your specific control requirements. With Solution Capabilities, your SSP becomes more accurate, your GRC org can work more efficiently and your teams can collaborate better.

Why Adopt Solution Capabilities:​

1. Accuracy: Manually written SSPs are riddled with errors that slow down audits and authorizations. Our OSCAL-based Risk Solutions platform automatically maintains and updates the machine-readable OSCAL format to prevent human error.
2. Efficiency: Your security requirements grow with your organization. Responding one by one to individual requirements is tedious and inefficient. A Solution Capability can map to multiple controls across any security catalog – allowing you to be flexible and agile as your security objectives increase.
3. Collaboration: Solution Capabilities provide a platform to drive shared risk adoption across the organization. Security becomes a collective organizational effort that’s not owned only by the GRC team

Three ways to respond to control requirements:​

Solution Capability Guiding Principles​

What is a Solution Capability:

1. Describe a security capability that addresses the who, what, how, and when
2. Standardized language that is catalog-agnostic to fulfill multi-catalog set of requirements
3. Flexible and agile to lift and replace the who, what, and when elements as the business evolves
4. Defines shared risk ownership across the organization and leveraged third party providers

For more information about Risk Solutions and Solution Capabilities, see Risk Solutions Explained.

Steps to Convert Custom / Existing Responses to Risk Solutions Architecture with AI (i.e. SaaS)

1. Initial Intake based on Existing SSP
   • Perform self-served intake / SSP ingestion to define elements and Risk Solutions inventory from existing SSP
   • Review the elements inventory created based on existing SSP for accuracy (elements can be updated or added on a continuous basis as your environment changes)
2. For each control implementation, run "Generate  Solution Capability" AI to view suggested Solution Capability options side-by-side with your custom responses for all control requirements mapped to the related Risk Solution in Paramify's Risk Solution Library.
   • Select an option and customize it as needed to reflect your solution accurately
   • Accept or Reject the Solution Capability option selected above.
   • If you accept the Solution Capability, remove the custom response to prevent both the Solution Capability and custom response from being duplicative in the SSP

Steps to Convert Custom / Existing Responses to Risk Solutions Architecture without AI (i.e. Self-Hosted)​

1. Initial Intake based on Existing SSP
   • Perform self-served intake / SSP ingestion to define elements and Risk Solutions inventory from existing SSP
   • Import all elements and Risk Solutions inventory based on existing SSP into your workspace
   • Apply suggested Solution Capabilities produced from step #1 to list of all security objective catalog requirements
2. Defining Foundation for Security Capabilities
   • Assess what is necessary vs. superfluous in existing custom response to meet associated control requirement
   • Consolidate multi-component capability existing custom responses to a generic main component capability
   • Define the security capability key elements from existing custom response:
     • Who - primary responsible owner of the capability
       • Multiple Who scenarios:
         • Partially inherited from a third party provider + Shared internal organizational ownership
         • Customer responsibility + Shared internal organizational ownership
     • What - main component driving the capability (ideally this is owned by the Who party)
     • How - procedures for implementing the capability (driven from the What element potentially in conjunction with other components)
     • When - frequency with which the capability is performed
3. Content Merge to Solution Capability Architecture (reach out to your CSM for a template to complete this phase)
   • Refine suggested Solution Capabilities created from the intake process based on outputs of phase #2 (custom responses and Risk Solutions can be viewed together in the controls implementation view as well as the Document Robot eMass deliverable)
   • Associate additional Solution Capabilities not mapped to the requirement based on context from custom response not addressed in suggested Solution Capabilities.

Custom Response vs Solution Capabilities

Ultimately it is up to you if you want to continue with the custom responses from your existing SSP or convert to Solution Capabilities.  Below are key considerations from a Paramify feature perspective to keep in mind as you move forward: