Comparable products or systems and their rankings in these areas should also be identified and discussed during these closeout meetings, to determine the degree of congruence a specific IA-CMM assessment has with expected norms and standards. Methods for addressing any low rankings and improving scores n areas assessed as poor would also be useful components of discussion. 4)

Different types of reporting are more effective for different situations, with quantitative assessments more appropriate when delivering reports to less technically-minded individuals or those not familiar with the processes of the system, while quantitative reports are fitting for those more directly knowledgeable regarding the specific workings of IT systems and security...

The assessments of an IA-CMM are applied to a set of five components or common features: Commitment to Perform, Ability to Perform, Activities Performed, Measurement and Analysis, and Verifying Implementation (Kashman 2011). Through such compartmentalized reporing, a comprehensive assessment of the organization/system can be created (Kashman 2011).
References

Foster, J. (2005). Buffer Overload Attacks. Rockland, MA: Syngress Publishing.

Kashman, P. (2011). CMM: An Introduction. Accessed 18 November 2011. http://homepages.com.pk/kashman/CMMIntro.htm

Stoneburner, A., Goguen, A. & Feringa, A. (2002). Risk Management Guide for Information Technology Systems. Falls Church, VA: Booz Allen Hamilton, Inc.