The purpose of Organizational Process Focus is to plan, implement, and deploy organizational process improvements based on a thorough understanding of current strengths and weaknesses of the organization’s operational resilience processes and process assets.
The organization’s processes include all operational resilience processes used by the organization and its organizational units. Candidate improvements to the organization’s processes and process assets are obtained from various sources, including the measurement of processes, lessons learned in implementing processes, results of process appraisals, results of post-event or incident handling, results of customer satisfaction evaluation, results of benchmarking against other organizations’ processes, and recommendations from other improvement initiatives in the organization.
Process improvement occurs in the context of the organization’s needs and is used to address the organization’s objectives. The organization encourages participation in process improvement activities by those who perform the process. The responsibility for facilitating and managing the organization’s process improvement activities, including coordinating the participation of others, is typically assigned to an operational resilience process group. The organization provides the long-term commitment and resources required to sponsor this group and to ensure the effective and timely deployment of improvements.
Careful planning is required to ensure that process improvement efforts across the organization are adequately managed and implemented. Results of the organization’s process improvement planning are documented in a process improvement plan.
The “organization’s process improvement plan” addresses appraisal planning, process action planning, pilot planning, and deployment planning. Appraisal plans describe the appraisal timeline and schedule, the scope of the appraisal, resources required to perform the appraisal, the reference model against which the appraisal will be performed, and logistics for the appraisal.
Process action plans usually result from appraisals and document how improvements targeting weaknesses uncovered by an appraisal will be implemented. Sometimes the improvement described in the process action plan should be tested on a small group before deploying it across the organization. In these cases, a pilot plan is generated.
When the improvement is to be deployed, a deployment plan is created. This plan describes when and how the improvement will be deployed across the organization.
Organizational process assets are used to describe, implement, and improve the organization’s processes.
Refer to the Organizational Process Definition process area for more information about establishing organizational process assets, including standard processes.
Strengths, weaknesses, and improvement opportunities for the organization’s processes are identified periodically and as needed.
Strengths, weaknesses, and improvement opportunities may be determined relative to a process standard or model. Process improvements should be selected to address the organization’s needs.
The descriptions of process needs and objectives for the organization are established and maintained.
The organization’s processes operate in a business context that must be understood. The organization’s business objectives, needs, and constraints determine the needs and objectives of the organization’s processes. Typically, issues related to customer satisfaction, finance, technology, quality, human resources, marketing, service continuity, and resilience are important process considerations.
Organizational process needs may be strongly influenced by the organization’s strategic objectives, critical success factors, and other factors. (Refer to the Enterprise Focus process area for information about establishing these factors as aligning principles for process management and improvement.)
The organization’s process needs and objectives cover aspects that include the following:
• characteristics of processes
• process performance objectives, such as impact avoidance and reduction of recovery time objectives
• process effectiveness
Typical work products
Subpractices
Refer to the Enterprise Focus process area for more information about establishing these work products.
Process performance objectives may be expressed in quantitative or qualitative terms.
Refer to the Measurement and Analysis process area for more information about establishing measurement objectives.
Essential characteristics of the organization’s processes are determined based on the following:
• processes currently being used in the organization
• standards imposed by the organization
• standards commonly imposed by the organization’s market sector
• standards commonly imposed by customers of the organization
The organization’s processes are appraised periodically and as needed to maintain an understanding of their strengths and weaknesses.
Process appraisals may be performed for the following reasons:
• to identify processes to be improved
• to confirm progress and make the benefits of process improvement visible
• to satisfy the needs of a customer-supplier relationship
• to motivate and facilitate buy-in
The buy-in gained during a process appraisal can be eroded significantly if it is not followed by an appraisal-based action plan.
Typical work products
Subpractices
Higher-level managers’ sponsorship includes the commitment to have the organization’s managers and staff participate in the process appraisal and to provide resources and funding to analyze and communicate findings of the appraisal.
Process appraisals may be performed on the entire organization or may be performed on a smaller part of an organization such as an organizational unit or line of business.
Process appraisals may also be scoped to specific types of assets (such as information, software, systems, hardware, or facilities) or from the vantage point of a specific discipline (such as security, continuity, or IT operations).
The scope of the process appraisal addresses the following:
• definition of the organization (e.g., sites, organizational units) to be covered by the appraisal
• definition of the assets and disciplines to be covered by the appraisal
• identification of the support functions that will represent the organization in the appraisal
• processes to be appraised
Process appraisals can occur in many forms. They should address the needs and objectives of the organization, which may change over time. For example, the appraisal may be based on a process model, such as the CERT Resilience Management Model, or on a national or international standard, such as ISO 27001. Appraisals may also be based on a benchmark comparison with other organizations in which practices that may contribute to improved performance are identified. The characteristics of the appraisal method may vary, including time and effort, makeup of the appraisal team, and the method and depth of investigation.
Improvements to the organization’s processes and process assets are identified.
Typical work products
Subpractices
Criteria for prioritization may include
• estimated cost and effort to implement the process improvements
• expected improvement against the organization’s improvement objectives and priorities
• potential barriers to the process improvements, and strategies for overcoming these barriers
Process actions that address improvements to the organization’s processes and process assets are planned and implemented.
The successful implementation of improvements requires participation in process action planning and implementation by process owners, those performing the process, and support organizations.
Process action plans to address improvements to the organization’s processes and process assets are established and maintained.
This stakeholder involvement helps to obtain buy-in on process improvements and increases the likelihood of effective deployment.
Process action plans are detailed implementation plans. These plans differ from the organization’s process improvement plan by targeting improvements that are defined to address weaknesses and that are usually identified by appraisals.
Typical work products
Subpractices
New, unproven, and major changes are piloted before they are deployed.
The teams and staff performing the process improvement actions are called “process action teams.” Process action teams typically include process owners and those who perform the process.
Process action plans are implemented.
Typical work products
Subpractices
Organizational process assets are deployed across the organization and process-related experiences are incorporated into organizational process assets.
The specific practices under this specific goal describe ongoing activities. New opportunities to benefit from organizational process assets and changes to them may arise. Deployment of standard processes and other organizational process assets must be continually supported in the organization.
Organizational process assets are deployed across the organization.
Deploying organizational process assets or changes to them should be performed in an orderly manner. Some organizational process assets or changes to them may not be appropriate for use in some parts of the organization (e.g., because of stakeholder requirements or the current life-cycle phase being implemented). It is therefore important that those who are or will be executing the process, as well as other supporting functions (e.g., training, quality assurance), be involved in deployment as necessary.
Refer to the Organizational Process Definition process area for more information about the deployment of organizational process assets, including the support of the organization’s process asset library.
Typical work products
Subpractices
Refer to the Organizational Training and Awareness process area for more information about establishing an organizational training capability.
Documenting changes to organizational process assets serves two main purposes:
• to enable the communication and review of changes
• to understand the relationship of changes in the organizational process assets to changes in process performance and results
The organization’s set of standard processes are deployed to organizational units (including projects at their start-up) and changes are deployed to them as appropriate.
It is important that organizational units use proven and effective processes to perform critical activities (e.g., planning, identifying requirements, and obtaining resources).
Organizational units should also periodically update their defined processes to incorporate the latest changes made to the organization’s set of standard processes when it benefits them. This periodic update helps to ensure that all organizational unit activities derive the full benefit of what other units have learned.
Refer to the Organizational Process Definition process area for more information about standard processes and tailoring guidelines.
Typical work products
Subpractices
Refer to each resilience management process area for more information about establishing an organizational unit’s defined processes.
Process-compliance audits are objective evaluations of organizational unit activities against the unit’s defined processes.
The organization’s set of standard processes and use of process assets are monitored.
By monitoring implementation, the organization ensures that the organization’s set of standard processes and other process assets are appropriately deployed to an organizational unit or line of business. Monitoring implementation helps the organization to develop an understanding of the organizational process assets being used and where they are used in the organization. Monitoring also helps to establish a broader context for interpreting and using process and product measures, lessons learned, and improvement information obtained from organizational units.
Refer to the Monitoring process area for more information about gathering and distributing process improvement information.
Typical work products
Subpractices
Reviewing selected process assets ensures that the organization and all organizational units are making appropriate use of the organization’s set of standard processes.
Process-related work products, measures, and improvement information derived from planning and performing the process are incorporated into organizational process assets.
Typical work products
Subpractices
Actions may be necessary to ensure that lessons learned are used appropriately.
Refer to the Measurement and Analysis process area for more information about analyzing measurement data.
Refer to the Organizational Process Definition process area for more information about establishing the organization’s measurement repository.
Process improvement proposals can address both process and technology improvements.
Process improvement proposals are documented as process change requests or problem reports as appropriate.
Some process improvement proposals may be incorporated into the organization’s process action plans.
Refer to the Generic Goals and Practices document in Appendix A for general guidance that applies to all process areas. This section provides elaborations relative to the application of the Generic Goals and Practices to the Organizational Process Focus process area.
The operational resilience management system supports and enables achievement of the specific goals of the Organizational Process Focus process area by transforming identifiable input work products to produce identifiable output work products.
Perform the specific practices of the Organizational Process Focus process area to develop work products and provide services to achieve the specific goals of the process area.
Elaboration:
Specific practices OPF:SG1.SP1 through OPF:SG3.SP4 are performed to achieve the goals of the organizational process focus process.
Organizational process focus is institutionalized as a managed process.
Establish and maintain governance over the planning and performance of the organizational process focus process.
Refer to the Enterprise Focus process area for more information about providing sponsorship and oversight to the organizational process focus process.
Subpractices
Elaboration:
Elaboration:
Establish and maintain the plan for performing the organizational process focus process.
Elaboration:
The plan for performing the organizational process focus process, which is often called “the process improvement plan,” differs from the process action plans described in OPF:SG2.SP1 and OPF:SG2.SP2. The plan called for in this generic practice addresses the comprehensive planning for all of the specific practices in this process area, from the establishment of organizational process needs all the way through to the incorporation of process-related experiences into the organizational process assets.
Subpractices
Elaboration:
Special consideration in the plan may have to be given to how the organization incorporates organizational process focus activities for staff who are not under direct control, including external entities such as contractors, service providers, suppliers, and other business partners.
Provide adequate resources for performing the organizational process focus process, developing the work products, and providing the services of the process.
Elaboration:
A process group typically manages the organizational process focus activities. This group typically is staffed by a core of professionals whose primary responsibility is coordinating organizational process improvement.
Refer to the Human Resource Management process area for information about acquiring staff for resilience roles and responsibilities.
Refer to the Financial Resource Management process area for information about budgeting for, funding, and accounting for organizational process focus activities.
Elaboration:
Assign responsibility and authority for performing the organizational process focus process, developing the work products, and providing the services of the process.
Refer to the Human Resource Management process area for more information about establishing resilience as a job responsibility, developing resilience performance goals and objectives, and measuring and assessing performance against these goals and objectives.
Subpractices
Elaboration:
Two groups are typically established and assigned responsibility for process improvement: (1) a management steering committee for process improvement to provide sponsorship by higher-level managers, and (2) a process group to facilitate and manage the process improvement activities.
Responsibility and authority may extend not only to staff inside the organization but to external entities with which the organization has a contractual agreement for improving and implementing standard processes and process assets.
Elaboration:
Refer to the External Dependencies Management process area for additional details about managing relationships with external entities.
Train the people performing or supporting the organizational process focus process as needed.
Refer to the Human Resource Management process area for more information about inventorying skill sets, establishing a skill set baseline, identifying required skill sets, and measuring and addressing skill deficiencies.
Subpractices
Elaboration:
Elaboration:
Place designated work products of the organizational process focus process under appropriate levels of control.
Elaboration:
Specific practice OPF:SG1.SP1 calls for documenting process needs and objectives. OPF:SG1.SP2 requires that process appraisal plans, findings, and improvement recommendations be captured. OPF:SG2.SP1 requires the documentation of process improvement action plans; OPF:SG3.SP1, changes to process assets resulting from action plans. This generic practice covers all organizational process focus work products that are to be placed under control.
Identify and involve the relevant stakeholders of the organizational process focus process as planned.
Subpractices
Elaboration:
Monitor and control the organizational process focus process against the plan for performing the process and take appropriate corrective action.
Refer to the Monitoring process area for more information about the collection, organization, and distribution of data that may be useful for monitoring and controlling processes.
Refer to the Measurement and Analysis process area for more information about establishing process metrics and measurement.
Refer to the Enterprise Focus process area for more information about providing process information to managers, identifying issues, and determining appropriate corrective actions.
Subpractices
Elaboration:
Elaboration:
Objectively evaluate adherence of the organizational process focus process against its process description, standards, and procedures, and address non-compliance.
Elaboration:
Review the activities, status, and results of the organizational process focus process with higher-level managers and resolve issues.
Refer to the Enterprise Focus process area for more information about providing sponsorship and oversight to the operational resilience management system.
Elaboration:
These reviews are typically in the form of a briefing presented to the management steering committee by the process group and the process action teams.
Organizational process focus is institutionalized as a defined process.
Establish and maintain the description of a defined organizational process focus process.
Elaboration:
Organizational process focus is itself a defined process. The subpractices that normally appear here are not included due to their metalevel and recursive nature (appraising processes, improving and deploying processes, and monitoring process performance). (Refer to the Generic Goals and Practices document in Appendix A for further guidance.)
Collect organizational process focus work products, measures, measurement results, and improvement information derived from planning and performing the process to support the future use and improvement of the organization’s processes and process assets.
Elaboration:
Subpractices