To develop an approach for the systematic assessment of the security aspects of the software development processes of software suppliers.

Security is becoming increasingly important in all of ESA's missions, rather than just in specific missions (Galileo, Copernicus) as was the case in the past. Therefore, the European space industry need to have a well-defined and standardized approach to assess the security processes of its suppliers, especially in terms of software development, where many security vulnerabilities can be introduced. Extending the existing software process assessment and improvement model (ECSS S4S) to also cover cyber security will ensure that suppliers meet the ever-increasing security requirements in a cost-effective and proven way. It is important to harmonise the approach for the assessment and improvement of software development processes in a context where it is vital to ensure the adequate security of the output work products. There are many possible approaches, standards and certification schemes. Therefore, having a clear, unambiguous way forward is essential, especially with the aim of standardizing the approach in ECSS.The current software process assessment and improvement ISO standard (ISO/IEC 33000 family) enables to asses process quality characteristic in the more generic sense, rather than only process capability specifically as was the case in the preceding standard (ISO/IEC 15504). This could allow to use this well-established model to assess process security (which is a process quality characteristic). This proposed research and development activity will investigate how this can best be approached and will develop the Process Assessment Model, the Measurement model, etc. to enable such assessments, which can then be proposed for an ECSS handbook or standard. The activity encompasses the following tasks:- Define a Process Assessment Model for cyber security.- Define a Measurement Model for cyber security.- Define a Process Reference Model for cyber security.- Demonstrate the compliance of these 3 models to ISO/IEC 33000. - Elaborate a preliminary proposal for a new or updated ECSS handbook (or standard). - Conduct at least one trial cyber security assessments using the new Process Assessment Model in order to evaluate how the theoretical model works in practice. Feed the lessons learned back into an updated version of the model.