MP091 'Updating Security Assurance Status'

Once a Party completes their Full User Security Assessment (FUSA) the SEC Panel assigns them one of four assurance statuses. Two of these, “Provisionally Approved” and “Deferred”, indicate significant security deficiencies that require substantial remediation, the severity of which are not reflected in the current SEC terminology.

The Security Sub Committee (SSC) believes that the assurance status set should be clear to Parties and accurately reflect the situation. As such it proposes to amend these assurance status as follows:

• “Provisionally Approved” to “Deferred”; and
• “Deferred” to “Rejected”.

Additionally, there is no current provision for the SSC to require a Party to undertake a second FUSA. The SEC only allows for updates to the original User Security Assessment Response. The SSC believes it would be more appropriate that where a Party is set a status of “Rejected” a second FUSA is more appropriate than an updated User Security Assessment Response. A second FUSA would provide assurance for all Parties, and the DCC, that the (significant) deficiencies have been addressed.

MP091 will amend SEC Section G to reflect the new Assurance Statuses and, where a User has a status set as “rejected”, allow the SSC to require a further FUSA be completed.