Incident Management Mission Diagnostic Method, Version 1.0 - Cert

SUCCESS AND
FAILURE DRIVERS
Each driver represents an outcome driver that can guide an IMC
toward successful or failing outcome 7 . A success driver is a condition
or circumstance (e.g., efficient work processes) that steers an IMC
toward a successful outcome, while a failure driver is a condition or
circumstance (e.g., inadequate budget) that steers an IMC toward an
unsuccessful outcome. In IMMD, the set of drivers is evaluated to
determine how many are success drivers, and how many are failure
drivers. Each IMC will have a mixture of success and failure drivers
influencing the eventual outcome. The goal is for the success drivers to
provide a stronger influence on the outcome and steer the IMC toward
success, while failure drivers (which can also be considered risks) are
mitigated.
BASIC IMMD
APPROACH
The philosophy underlying the IMMD is that the relative number of
success and failure drivers can be used to forecast an IMC’s potential
for success. The analysis of drivers in IMMD has two parts:
1. Evaluate each driver to determine the extent to which it is a
success or failure driver.
2. Analyze the entire set of drivers to estimate the overall potential
for the success of the IMC.
7
An outcome here is defined as the end result of a specific mission. In the case of a CSIRT, a successful outcome
could be that all computer security incidents are successfully managed in a timely manner, with little adverse impact
to the organization. An unsuccessful outcome might be that security incidents are undetected and cause significant,
costly damage to constituent systems and data.
8 | CMU/SEI-2008-TR-007