Incident Management Mission Diagnostic Method, Version 1.0 - Cert

6.2 ACTIVITY PRA2: SET THE IMMD SCOPE
INTRODUCTION
This activity determines the boundaries of the IMMD based on
requirements and constraints (schedule, funding, logistics, etc.).
The scope defines the extent, or range, of the IMC to be included in
this IMMD. The scope is framed around the mission or goals of the
IMC and the requirements of the IMMD. The scope sets the context
for all data collection, analysis, and planning activities. For example,
some groups or process functions may be eliminated from the analysis
due to schedule or contractual constraints. This activity is also used to
collect information (if possible) from stakeholders related to the IMC’s
success criteria. Stakeholders will usually have some opinion as to
what constitutes success for this IMC. This information is used later to
establish the IMC’s success threshold 13 .
WHAT IS SCOPE?
The scope of the IMMD essentially defines how much of the IMC is to
be included. For example:
• The IMMD could be limited to only the group of people officially
designated as the incident response team or CSIRT
• Contractors or service providers may be excluded or included
• One of the incident management functions, such as Protect, could
be excluded
• Specific groups in the organization that would be difficult or timeconsuming
to include, such as remotely located groups or groups
within secure facilities that the analysis team cannot access, could
be excluded
OBJECTIVES
This activity answers the following question:
• What is the scope of the IMMD?
The main objectives of this activity are to set the scope of the IMMD
and to gather stakeholder input on the IMC’s success threshold.
13 Note that the success threshold could be set here or later, but it must be set no later than in activity A5 Establish
the IMC success profile.
28 | CMU/SEI-2008-TR-007