Contents

List of Figures

List of Tables

Preface

Acknowledgments

Part One—About the CERT Resilience Management Model

1. Introduction

1.1 The Influence of Process Improvement and Capability Maturity Models

1.2 The Evolution of CERT-RMM

1.3 CERT-RMM and CMMI Models

1.4 Why CERT-RMM Is Not a Capability Maturity Model

2. Understanding Key Concepts in CERT-RMM

2.1 Foundational Concepts

2.1.1 Disruption and Stress

2.1.2 Convergence

2.1.3 Managing Operational Resilience

2.2 Elements of Operational Resilience Management

2.2.1 Services

2.2.2 Business Processes

2.2.3 Assets

2.2.4 Resilience Requirements

2.2.5 Strategies for Protecting and Sustaining Assets

2.2.6 Life-Cycle Coverage

2.3 Adapting CERT-RMM Terminology and Concepts

3. Model Components

3.1 The Process Areas and Their Categories

3.1.1 Process Area Icons

3.2 Process Area Component Categories

3.2.1 Required Components

3.2.2 Expected Components

3.2.3 Informative Components

3.3 Process Area Component Descriptions

3.3.1 Purpose Statements

3.3.2 Introductory Notes

3.3.3 Related Process Areas Section

3.3.4 Summary of Specific Goals and Practices

3.3.5 Specific Goals and Practices

3.3.6 Generic Goals and Practices

3.3.7 Typical Work Products

3.3.8 Subpractices, Notes, Example Blocks, Generic Practice Elaborations, References, and Amplifications

3.4 Numbering Scheme

3.5 Typographical and Structural Conventions

4. Model Relationships

4.1 The Model View

4.1.1 Enterprise Management

4.1.2 Engineering

4.1.3 Operations

4.1.4 Process Management

4.2 Objective Views for Assets

4.2.1 People

4.2.2 Information

4.2.3 Technology

4.2.4 Facilities

Part Two—Process Institutionalization and Improvement

5. Institutionalizing Operational Resilience Management Processes

5.1 Overview

5.2 Understanding Capability Levels

5.3 Connecting Capability Levels to Process Institutionalization

5.3.1 Capability Level 0: Incomplete

5.3.2 Capability Level 1: Performed

5.3.3 Capability Level 2: Managed

5.3.4 Capability Level 3: Defined

5.3.5 Other Capability Levels

5.4 CERT-RMM Generic Goals and Practices

5.4.1 CERT-RMM Elaborated Generic Goals and Practices

5.5 Applying Generic Practices

5.6 Process Areas That Support Generic Practices

6. Using CERT-RMM

6.1 Examples of CERT-RMM Uses

6.1.1 Supporting Strategic and Operational Objectives

6.1.2 A Basis for Evaluation, Guidance, and Comparison

6.1.3 An Organizing Structure for Deployed Practices

6.1.4 Model-Based Process Improvement

6.2 Focusing CERT-RMM on Model-Based Process Improvement

6.2.1 Making the Business Case

6.2.2 A Process Improvement Process

6.3 Setting and Communicating Objectives Using CERT-RMM

6.3.1 Organizational Scope

6.3.2 Model Scope

6.3.3 Capability Level Targets

6.4 Diagnosing Based on CERT-RMM

6.4.1 Formal Diagnosis Using the CERT-RMM Capability Appraisal Method

6.4.2 Informal Diagnosis

6.5 Planning CERT-RMM–Based Improvements

6.5.1 Analyzing Gaps

6.5.2 Planning Practice Instantiation

7. CERT-RMM Perspectives

Using CERT-RMM in the Utility Sector
by Darren Highfill and James Stevens

Addressing Resilience as a Key Aspect of Software Assurance Throughout the Software Life Cycle
by Julia Allen and Michele Moss

Raising the Bar on Business Resilience
by Nader Mehravari, PhD

Measuring Operational Resilience Using CERT-RMM
by Julia Allen and Noopur Davis

Part Three—CERT-RMM Process Areas

Asset Definition and Management

Access Management

Communications

Compliance

Controls Management

Environmental Control

Enterprise Focus

External Dependencies Management

Financial Resource Management

Human Resource Management

Identity Management

Incident Management and Control

Knowledge and Information Management

Measurement and Analysis

Monitoring

Organizational Process Definition

Organizational Process Focus

Organizational Training and Awareness

People Management

Risk Management

Resilience Requirements Development

Resilience Requirements Management

Resilient Technical Solution Engineering

Service Continuity

Technology Management

Vulnerability Analysis and Resolution

Part Four—The Appendices

A. Generic Goals and Practices

B. Targeted Improvement Roadmaps

C. Glossary of Terms

D. Acronyms and Initialisms

E. References

Book Contributors

Index