IM8 reform assessment results
Overview
With the IM8 reform, government systems are evaluated based on system security plans (SSPs) tailored to each DGP Sub-System’s risk profile.
The assessment results feature provides visibility into compliance findings identified by CloudSCAPE and CodeSCAPE, based on automated checks mapped to relevant IM8 reform controls. This helps agencies track non-compliance areas that can be programmatically evaluated.
Access and prerequisites
To view the IM8 reform assessment results for a given SSP:
- You must have admin or editor access to the relevant SSP.
- Access rights are governed by the IM8 reform portal.
Refer to Part 4 – “Access roles” of the IM8 reform user guide.
Before results can be viewed:
- The SSP must be endorsed by your CISO and CIO.
Refer to Part 3 – “Obtain support and approval” of the IM8 reform user guide. - The SSP’s DGP Sub-System must be correctly linked to:
- Cloud accounts (for CloudSCAPE evaluation), which can be done through the CMP portal.
- SHIP-HATS GitLab projects (for CodeSCAPE evaluation), which can be done in CodeSCAPE’s Sub-System view through the ‘Assign’ buttons.
Source systems and evaluation logic
Source systems
- CloudSCAPE evaluates your linked cloud accounts.
- CodeSCAPE evaluates your linked SHIP-HATS GitLab repositories.
Evaluation basis
- Results are mapped to IM8 reform controls based on available automated checks.
- Only controls with implemented automation appear in the results.
Frequency
- Evaluations are performed once daily by both CloudSCAPE and CodeSCAPE.
- Results do not update in real time.
Understanding your results
- Non-compliant controls indicate where one or more checks have failed.
- No result for a control means it is not evaluated by CodeSCAPE or CloudSCAPE due to lack of automation or resource linkage.
- Controls outside the scope of CloudSCAPE or CodeSCAPE do not appear in the results.
Note
Changes made to your SSP or sub-system composition (for example, linking new GitLab repositories or cloud accounts) will be reflected in the next day’s evaluation, not immediately.
