Schellman Software Security Assessment (S³A)

2. Control Mapping and Testing (2 – 4 weeks)

As we map your security controls to the framework subcategories, we’ll begin with a select number of control areas and range upwards to a full NIST Secure Software Development Framework assessment.

For each identified subcategory you include, we’ll review documentation and technical evidence and perform testing to determine whether or not these objectives have been met.

3. Remediation and Finding Closure (1-2 weeks)

Wherever we note where you did not meet control requirements—or where you have opportunities to improve security and development flow—you’ll develop, document, and implement remediation plans before we review your updates and perform retesting. 

4. Final Reporting (2 – 3 weeks)

We’ll provide a final and detailed analysis of the framework as well as our findings and recommendations for improving your software security and achieving compliance with relevant regulations and standards.

*You can also request an external-facing report documenting the scope, activities, and high-level findings related to the assessment.

In addition, Schellman will prepare the attestations and required documentation for reporting agencies and aid in submitting documentation.