Organizational Process Definition

Process

Purpose

The purpose of Organizational Process Definition is to establish and maintain a usable set of organizational process assets and work environment standards for operational resilience.

Introductory Notes

Organizational process assets enable consistent resilience management process performance across the organization and provide a basis for cumulative, long-term benefits to the organization.

The organization’s process asset library is a collection of items maintained by the organization for use by the people and organizational units of the organization. This collection of items includes descriptions of processes and process elements, descriptions of life-cycle models, process tailoring guidelines, process-related documentation, and data. The organization’s process asset library supports organizational learning and process improvement by allowing the sharing of best practices and lessons learned across the organization.

The organization’s set of standard processes is tailored by organizational units to create their defined processes. The other organizational process assets are used to support tailoring and the implementation of the defined processes. The work environment standards are used to guide creation of organizational unit work environments.

A standard process is composed of other processes (i.e., subprocesses) or process elements. A process element is the fundamental (i.e., atomic) unit of process definition and describes the activities and tasks to consistently perform work. Process architecture provides rules for connecting the process elements of a standard process. The organization’s set of standard processes may include multiple process architectures.

Related Process Areas

Refer to the Organizational Process Focus process area for more information about organizational-process–related matters.

Summary of Specific Goals and Practices

Specific Practices by Goal

Establish Organizational Process Assets

A set of organizational process assets is established and maintained.

Establish Standard Processes

The organization’s set of standard processes is established and maintained.

Standard processes may be defined at multiple levels in an enterprise and they may be related in a hierarchical manner. For example, an enterprise may have a set of standard processes that is tailored by individual organizational units (e.g., a division or site) in the enterprise to establish its set of standard processes. The set of standard processes may also be tailored for each of the organization’s lines of business or product lines. Thus “the organization’s set of standard processes” can refer to the standard processes established at the organization level and standard processes that may be established at lower levels, although some organizations may have only a single level of standard processes.

Multiple standard processes may be required to address the needs of different levels of organizational units or disciplines (for example, security versus business continuity). The organization’s set of standard processes contains process elements that may be interconnected according to one or more process architectures that describe the relationships among these process elements.

The organization’s set of standard processes typically includes technical, management, administrative, and support processes.

The organization’s set of standard processes should collectively cover all processes needed by the organization and its organizational units.

Typical Work Products

1. Organization’s set of standard processes

Subpractices

1. Decompose each standard process into constituent process elements to the level of detail needed to understand and describe the process.

   Each process element covers a bounded and closely related set of activities. The descriptions of the process elements may be templates to be filled in, fragments to be completed, abstractions to be refined, or complete descriptions to be tailored or used unmodified. These elements are described in sufficient detail such that the process, when fully defined, can be consistently performed by appropriately trained and skilled people.

   These are examples of process elements:

   • templates for creating plans and policies

   • descriptions of work product design methodology

   • templates for documenting incidents

   • templates for conducting management reviews

2. Specify the critical attributes of each process element.

   These are examples of critical attributes:

   • process roles

   • applicable procedures, standards, and guidelines

   • applicable methods, tools, techniques, and resources

   • process performance objectives

   • entry criteria

   • inputs

   • product and process measures to be collected and used

   • verification points (e.g., peer reviews)

   • outputs

   • interfaces

   • exit criteria

3. Specify the relationships of the process elements.

   These are examples of relationships:

   • ordering of the process elements

   • interfaces among the process elements

   • interfaces with external processes

   • interdependencies among the process elements

   The rules for describing the relationships among process elements are referred to as “process architecture.” The process architecture provides essential requirements and guidelines. The detailed specifications of these relationships are covered in the descriptions of the defined processes that are tailored from the organization’s set of standard processes.

4. Ensure that the organization’s set of standard processes adheres to applicable process policies, standards, and models.

   Adherence to applicable process policies, standards, and models is typically demonstrated by developing a mapping from the organization’s set of standard processes to the relevant process policies, standards, and models. In addition, this mapping will be a useful input to future appraisals.

5. Ensure that the organization’s set of standard processes satisfies the process needs and objectives of the organization.

   Refer to the Organizational Process Focus process area for more information about establishing and maintaining the organization’s process needs and objectives.

6. Ensure that there is appropriate integration among the processes that are included in the organization’s set of standard processes.
7. Document the organization’s set of standard processes.
8. Conduct peer reviews on the organization’s set of standard processes.
9. Revise the organization’s set of standard processes as necessary.

Establish Tailoring Criteria and Guidelines

Tailoring criteria and guidelines for the organization’s set of standard processes are established and maintained.

The tailoring criteria and guidelines describe the following:

• how the organization’s set of standard processes and organizational process assets are used to create the defined processes

• mandatory requirements that must be satisfied by the defined processes (e.g., the subset of the organizational process assets that are essential for any defined process)

• options that can be exercised and criteria for selecting among the options

• procedures that must be followed in performing and documenting process tailoring

Flexibility in tailoring and defining processes is balanced with ensuring appropriate consistency in the processes across the organization. Flexibility is needed to address contextual variables such as the domain, technical difficulty of the work, and experience of the people implementing the process. Consistency across the organization is needed so that organizational standards, objectives, and strategies are appropriately addressed and process data and lessons learned can be shared.

Tailoring criteria and guidelines may allow for using a standard process “as is,” with no tailoring.

Typical work products

1. Tailoring guidelines for the organization’s set of standard processes
2. Process documentation standards
3. Standard process requirements waivers

Subpractices

1. Specify the selection criteria and procedures for tailoring the organization’s set of standard processes.

   These are examples of criteria and procedures:

   • criteria for selecting process elements from the organization’s set of standard processes

   • procedures for tailoring the selected process elements to accommodate specific process characteristics and needs

   These are examples of tailoring actions:

   • modifying process elements

   • replacing process elements

   • reordering process elements

2. Specify the standards for documenting the defined processes.
3. Specify the procedures for submitting and obtaining approval of waivers from the requirements of the organization’s set of standard processes.
4. Document the tailoring guidelines for the organization’s set of standard processes.
5. Conduct peer reviews on the tailoring guidelines.
6. Revise the tailoring guidelines as necessary.

Establish the Organization’s Measurement Repository

The organization’s measurement repository is established and maintained.

The repository contains both product and process measures that are related to the organization’s set of standard processes. It also contains or refers to the information needed to understand and interpret the measures and assess them for reasonableness and applicability. For example, the definitions of the measures are used to compare similar measures from different processes.

Typical work products

1. Definition of the common set of product and process measures for the organization’s set of standard processes
2. Design of the organization’s measurement repository
3. Organization’s measurement repository (that is, the repository structure and support environment)
4. Organization’s measurement data
5. Procedures for storing, updating, and retrieving measures

Subpractices

1. Determine the organization’s needs for storing, retrieving, and analyzing measurements.
2. Define a common set of process and product measures for the organization’s set of standard processes.

   The measures in the common set are selected based on the organization’s set of standard processes. They are selected for their ability to provide visibility into process performance to support expected business objectives. The common set of measures may vary for different standard processes.

   Operational definitions for the measures specify the procedures for collecting valid data and the point in the process where the data will be collected.

   These are examples of classes of commonly used measures:

   • estimates of work product size (e.g., pages)

   • estimates of effort and cost (e.g., person hours)

   • actual measures of size, effort, and cost

   • quality measures (e.g., number of incidents reported)

   • peer review coverage

   • test coverage

   • reliability measures (e.g., mean time to failure)

   Refer to the Measurement and Analysis process area for more information about defining measures.

3. Design and implement the measurement repository.
4. Specify the procedures for storing, updating, and retrieving measures.
5. Conduct peer reviews on the definitions of the common set of measures and the procedures for storing and retrieving measures.
6. Enter the specified measures into the repository.

   Refer to the Measurement and Analysis process area for more information about collecting and analyzing data.

7. Make the contents of the measurement repository available for use by the organization and organizational units as appropriate.
8. Revise the measurement repository, common set of measures, and procedures as the organization’s needs change.

Establish the Organization’s Process Asset Library

The organization’s process asset library is established and maintained.

Typical work products

1. Design of the organization’s process asset library
2. Organization’s process asset library
3. Selected items to be included in the organization’s process asset library
4. Catalog of items in the organization’s process asset library
5. Procedures for storing and retrieving library items

Subpractices

1. Design and implement the organization’s process asset library, including the library structure and support environment.
2. Specify the criteria for including items in the library.

   The items are selected based primarily on their relationship to the organization’s set of standard processes.

3. Specify the procedures for storing and retrieving items.
4. Enter the selected items into the library and catalog them for easy reference and retrieval.
5. Make the items available for use by organizational units.
6. Periodically review the use of each item and use the results to maintain the library contents.
7. Revise the organization’s process asset library as necessary.

Establish Work Environment Standards

Work environment standards are established and maintained.

Work environment standards allow the organization to benefit from common tools, training, and maintenance, as well as cost savings from volume purchases. Work environment standards address the needs of all stakeholders and consider productivity, cost, availability, security, and workplace health, safety, and ergonomic factors. Work environment standards can include guidelines for tailoring and/or the use of waivers that allow adaptation of the organizational unit’s work environment to meet specific needs.

Typical work products

1. Work environment standards

Subpractices

1. Evaluate commercially available work environment standards appropriate for the organization.
2. Adopt existing work environment standards and develop new ones to fill gaps based on the organization’s process needs and objectives.

Establish Rules and Guidelines for Integrated Teams

Organizational rules and guidelines for the structure, formation, and operation of integrated teams are established and maintained.

When executing work that crosses organizational lines, particularly work that represents convergent disciplines such as operational risk management, service continuity, and incident response, integrated teams must be structured, formed, and operated effectively.

Operating rules and guidelines for integrated teams define and control how teams are created and how they interact to accomplish objectives. Members of integrated teams must understand the standards for work and participate according to those standards.

Structuring integrated teams involves defining the number of teams, the type of each team, and how each team relates to the others in the structure. Forming integrated teams involves chartering each team, assigning team members and team leaders, and providing resources to each team to accomplish work.

Typical work products

1. Rules and guidelines for structuring and forming integrated teams

Subpractices

1. Establish and maintain empowerment mechanisms to enable timely decision making.

   In a successful teaming environment, clear channels of responsibility and authority must be established. Issues can arise at any level of the organization when integrated teams assume too much or too little authority and when it is unclear who is responsible for making decisions. Documenting and deploying organizational guidelines that clearly define the empowerment of integrated teams can prevent these issues.

2. Establish rules and guidelines for structuring and forming integrated teams.

   Organizational process assets can help the organizational unit to structure and implement integrated teams. Such assets may include the following:

   • team structure guidelines

   • team formation guidelines

   • team authority and responsibility guidelines

   • guidelines for establishing lines of communication, authority, and escalation

   • team leader selection criteria

3. Define the expectations, rules, and guidelines that guide how integrated teams work collectively.

   These rules and guidelines establish organizational practices for consistency across integrated teams and can include the following:

   • how interfaces among integrated teams are established and maintained

   • how assignments are accepted and transferred

   • how resources and inputs are accessed

   • how work gets done

   • who checks, reviews, and approves work

   • how work is approved

   • how work is delivered and communicated

   • who reports to whom

   • what the reporting requirements (e.g., cost, schedule, performance status), measures, and methods are

   • which progress reporting measures and methods are used

4. Maintain the rules and guidelines for structuring and forming integrated teams.
5. Establish and maintain organizational guidelines to help team members balance their team and home organization responsibilities.

   A “home organization” is the organizational unit to which team members are assigned when they are not on an integrated team. A home organization may be called a “functional organization,” “home base,” “home office,” or “direct organization.”

Elaborated Generic Practices by Goal

Refer to the Generic Goals and Practices document in Appendix A for general guidance that applies to all process areas. This section provides elaborations relative to the application of the Generic Goals and Practices to the Organizational Process Definition process area.

Achieve Specific Goals

The operational resilience management system supports and enables achievement of the specific goals of the Organizational Process Definition process area by transforming identifiable input work products to produce identifiable output work products.

Perform Specific Practices

Perform the specific practices of the Organizational Process Definition process area to develop work products and provide services to achieve the specific goals of the process area.

Elaboration:

Specific practices OPD:SG1.SP1 through OPD:SG1.SP6 are performed to achieve the goals of the organizational process definition process.

Institutionalize a Managed Process

Organizational process definition is institutionalized as a managed process.

Establish Process Governance

Establish and maintain governance over the planning and performance of the organizational process definition process.

Refer to the Enterprise Focus process area for more information about providing sponsorship and oversight to the organizational process definition process.

Subpractices

1. Establish governance over process activities.

   Elaboration:

   Governance over the organizational process definition process may be exhibited by

   • establishing an operational resilience process group (ORPG) to facilitate the development and maintenance of standard processes and process assets

   • developing and publicizing higher-level managers’ objectives and requirements for the process

   • sponsoring and funding process activities

   • sponsoring and providing oversight of policy, procedures, standards, and guidelines for process definition activities and for organizational use of these activities and work products

   • guiding and supporting the enforcement of standard processes and process assets

   • providing input on standard process definitions

   • making higher-level managers aware of applicable compliance obligations related to organization process definition, and regularly reporting on the organization’s satisfaction of these obligations to higher-level managers

   • verifying that the process supports strategic resilience objectives and is focused on the assets and services that are of the highest relative value in meeting strategic objectives

   • regular reporting from organizational units to higher-level managers on operational process definition activities and results, and the use and tailoring of standard processes

   • creating dedicated higher-level management feedback loops on decisions about the process and recommendations for improving the process

   • conducting regular internal and external audits and related reporting to audit committees on process effectiveness

   • creating formal programs to measure the effectiveness of process activities, and reporting these measurements to higher-level managers

2. Develop and publish organizational policy for the process.

   Elaboration:

   The organizational process definition policy should address

   • responsibility, authority, and ownership for performing operational process definition activities, including process selection and tailoring

   • the definition and use of standard processes for managing operational resilience

   • procedures, standards, and guidelines for

   — selecting and tailoring standard processes in accordance with criteria and guidelines

   — contributing to, using, storing, updating, and retrieving measures from the measurement repository

   — contributing to, using, storing, and retrieving items from the process asset library

   — the work environment (Refer to OPD:SG1.SP5 for examples.)

   — the structure, formation, and operation of integrated teams

   — obtaining waivers to the use of standard processes and work environment standards

   • methods for measuring adherence to policy, exceptions granted, and policy violations

Plan the Process

Establish and maintain the plan for performing the organizational process definition process.

Elaboration:

The plan for performing the organizational process definition process can be part of (or referenced by) the organization’s process improvement plan.

Subpractices

1. Define and document the plan for performing the process.

   Elaboration:

   Special consideration in the plan may have to be given to how the organization incorporates organizational process definition activities for staff who are not under direct control, including external entities such as contractors, service providers, suppliers, and other business partners.

2. Define and document the process description.
3. Review the plan with relevant stakeholders and get their agreement.
4. Revise the plan as necessary.

Provide Resources

Provide adequate resources for performing the organizational process definition process, developing the work products, and providing the services of the process.

Subpractices

1. Staff the process.

   Elaboration:

   A process group typically manages the organizational process definition activities. This group typically is staffed by a core of professionals whose primary responsibility is coordinating organizational process improvement.

   These are examples of staff required to perform the organizational process definition process:

   • operational resilience process group members

   • process owners

   • subject matter experts, including staff knowledgeable about each operational resilience management process area and how to reflect process requirements in standard process definitions and process measures

   • subject matter experts in project management, configuration management, quality assurance, and relevant engineering disciplines such as security and business continuity

   • staff responsible for developing standard process definitions and work environment standards and ensuring they are aligned with stakeholder requirements and needs

   • external entities involved in developing and using standard process definitions

   • staff responsible for managing external entities that have contractual obligations to use the work products of the organizational process development process

   • internal and external auditors responsible for reporting to appropriate committees on process effectiveness

   Refer to the Human Resource Management process area for information about acquiring staff for resilience roles and responsibilities.

2. Fund the process.

   Refer to the Financial Resource Management process area for information about budgeting for, funding, and accounting for organizational process definition activities.

3. Provide necessary tools, techniques, and methods to perform the process.

   Elaboration:

   These are examples of tools, techniques, and methods to support the organizational process definition process:

   • database and repository management systems

   • process modeling tools

   • web page builders and browsers

   • templates and other tools in support of documenting process element descriptions and standard process definitions

   • templates for documenting process and product measures

   • peer review checklists

   • templates for integrated team charters

Assign Responsibility

Assign responsibility and authority for performing the organizational process definition process, developing the work products, and providing the services of the process.

Refer to the Human Resource Management process area for more information about establishing resilience as a job responsibility, developing resilience performance goals and objectives, and measuring and assessing performance against these goals and objectives.

Subpractices

1. Assign responsibility and authority for performing the process.

   Elaboration:

   Responsibility and authority may extend not only to staff inside the organization but to external entities with which the organization has a contractual agreement for using standard process definitions, standard process and product measures, and work environment standards.

2. Assign responsibility and authority for performing the specific tasks of the process.

   Elaboration:

   Responsibility and authority for performing organizational process definition tasks can be formalized by

   • defining roles and responsibilities in the process plan

   • including process tasks and responsibility for these tasks in specific job descriptions

   • developing policy requiring organizational unit managers, line of business managers, project managers, and asset and service owners to participate in and derive benefit from operational resilience management processes, services, and assets under their ownership or custodianship

   • developing policy requiring the use and tailoring, if needed, of standard process definition and work environment standards

   • including process tasks in staff performance management goals and objectives, with requisite measurement of progress against these goals

   • developing and implementing contractual instruments (as well as service level agreements) with external entities to use and tailor standard processes and work environment standards, where applicable

   • including process work products in measuring performance of external entities against service level agreements

   Refer to the External Dependencies Management process area for additional details about managing relationships with external entities.

3. Confirm that people assigned with responsibility and authority understand it and are willing and able to accept it.

Train People

Train the people performing or supporting the organizational process definition process as needed.

Refer to the Human Resource Management process area for more information about inventorying skill sets, establishing a skill set baseline, identifying required skill sets, and measuring and addressing skill deficiencies.

Subpractices

1. Identify process skill needs.

   Elaboration:

   These are examples of skills required in the organizational process definition process:

   • process modeling and definition

   • database management

   • process and product measurement

   • knowledge unique to each operational resilience management process area, and assets and services that are the focus of these processes

   • expertise in relevant engineering disciplines such as security and business continuity

   • communication

   • team building

   • knowledge of the tools, techniques, and methods necessary to develop and maintain process work products, including those necessary to perform the process using the selected methods, techniques, and tools identified in OPD:GG2.GP3 subpractice 3

   • knowledge necessary to elicit and prioritize stakeholder requirements and needs and interpret them to develop effective standard process definitions, measures, and work environment standards

2. Identify process skill gaps based on available resources and their current skill levels.
3. Identify training opportunities to address skill gaps.

   Elaboration:

   These are examples of training topics:

   • process improvement reference models

   • planning, managing, and monitoring processes

   • process modeling and definition

   • developing a tailorable standard process

   • developing work environment standards

   • ergonomics

   • supporting resilience staff in understanding the organizational process development process and their roles and responsibilities with respect to its activities

   • working with external entities that have responsibility for using organizational process development work products

   • using organizational process development methods, tools, and techniques, including those identified in OPD:GG2:GP3 subpractice 3

Manage Work Product Configurations

Place designated work products of the organizational process definition process under appropriate levels of control.

Elaboration:

Specific practice OPD SG1.SP1 calls for documenting all standard process definitions. OPD:SG1.SP2 requires the documentation of tailoring guidelines for standard processes. This generic practice covers all organizational process definition work products that are to be placed under control.

Identify and Involve Relevant Stakeholders

Identify and involve the relevant stakeholders of the organizational process definition process as planned.

Subpractices

1. Identify process stakeholders and their appropriate involvement.

   Elaboration:

   These are examples of stakeholders of the organizational process definition process:

   • business process and operational resilience process owners

   • asset owners and custodians

   • service owners

   • organizational unit and line of business managers responsible for high-value services and assets

   • project managers and others responsible for standing up integrated teams

   • external entities responsible for managing high-value assets and services and for using standard process definitions

   • internal and external auditors

   Stakeholders are involved in various tasks in the organizational process definition process, such as

   • reviewing the organization’s set of standard processes

   • resolving issues with the tailoring guidelines

   • assessing the definitions of the common set of process and product measures

   • reviewing the work environment standards

   • establishing and maintaining organizational rules and guidelines for the structuring and forming of integrated teams

   • establishing and maintaining integrated team empowerment mechanisms

   • planning for the process

   • making decisions about the process

   • making commitments to process plans and activities

   • reviewing and appraising the effectiveness of process activities

   • establishing requirements for the process

   • resolving issues in the process

2. Communicate the list of stakeholders to planners and those responsible for process performance.
3. Involve relevant stakeholders in the process as planned.

Monitor and Control the Process

Monitor and control the organizational process definition process against the plan for performing the process and take appropriate corrective action.

Refer to the Monitoring process area for more information about the collection, organization, and distribution of data that may be useful for monitoring and controlling processes.

Refer to the Measurement and Analysis process area for more information about establishing process metrics and measurement.

Refer to the Enterprise Focus process area for more information about providing process information to managers, identifying issues, and determining appropriate corrective actions.

Subpractices

1. Measure actual performance against the plan for performing the process.
2. Review accomplishments and results of the process against the plan for performing the process.

   Elaboration:

   These are examples of metrics for the organizational process definition process:

   • percentage of organizational units (including projects) using the process architectures and process elements of the organization’s set of standard processes

   • percentage of standard processes that have been tailored, by organizational unit

   • number of unapproved changes to the process asset library

   • number of waivers by standard process

   • number of waivers by work environment standard

   • defect density of each process element of the organization’s set of standard processes

   • percentage of product and process measures residing in the measurement repository that are used in status reports

   • number of worker’s compensation claims due to ergonomic problems

   • schedule for development of a process or process change

   • number of process risks referred to the risk management process; number of risks where corrective action is still pending (by risk rank)

   • level of adherence to process policies; number of policy violations; number of policy exceptions requested and number approved

   • number of process activities that are on track per plan

   • rate of change of resource needs to support the process

   • rate of change of costs to support the process

3. Review activities, status, and results of the process with the immediate level of managers responsible for the process and identify issues.

   Elaboration:

   Periodic reviews of the organizational process definition process are needed to ensure that

   • standard processes are in active use by all organizational units

   • skills necessary to develop and tailor organizational process definitions are available or obtainable

   • the effectiveness of standard organizational processes and tailoring guidelines is regularly monitored, reported, evaluated, and improved

   • the waiver process is not abused

   • the performance of process activities is being monitored and regularly reported

   • process issues are referred to the risk management process when necessary

   • actions requiring management involvement are elevated in a timely manner

   • key measures are within acceptable ranges as demonstrated in governance dashboards or scorecards and financial reports

   • actions resulting from internal and external audits are being closed in a timely manner

4. Identify and evaluate the effects of significant deviations from the plan for performing the process.
5. Identify problems in the plan for performing and executing the process.
6. Take corrective action when requirements and objectives are not being satisfied, when issues are identified, or when progress differs significantly from the plan for performing the process.
7. Track corrective action to closure.

Objectively Evaluate Adherence

Objectively evaluate adherence of the organizational process definition process against its process description, standards, and procedures, and address non-compliance.

Elaboration:

Review Status with Higher-Level Managers

Review the activities, status, and results of the organizational process definition process with higher-level managers and resolve issues.

Refer to the Enterprise Focus process area for more information about providing sponsorship and oversight to the operational resilience management system.

Institutionalize a Defined Process

Organizational process definition is institutionalized as a defined process.

Establish a Defined Process

Establish and maintain the description of a defined organizational process definition process.

Elaboration:

Organizational process definition is itself a defined process. The subpractices that normally appear in this practice are not included due to their metalevel and recursive nature (selecting from the organization’s set of standard processes, tailoring standard processes, meeting organizational process objectives, documenting the tailored process, and revising as necessary). (Refer to the Generic Goals and Practices document in Appendix A for further guidance.)

Collect Improvement Information

Collect organizational process definition work products, measures, measurement results, and improvement information derived from planning and performing the process to support the future use and improvement of the organization’s processes and process assets.

Elaboration:

Subpractices

1. Store process and work product measures in the organization’s measurement repository. (Refer to OPD:SG1.SP3 for further details.)
2. Submit documentation for inclusion in the organization’s process asset library. (Refer to OPD:SG1.SP4 for further details.)
3. Document lessons learned from the process for inclusion in the organization’s process asset library.
4. Propose improvements to the organizational process assets.