vPLfv

sion of the process?” and “Who performs the process?” The workflow descriptions included
in our report list a fairly inclusive set of potential answers to each question. Therefore there
are no real roles and responsibilities assigned to any one group in the workflow descriptions
included here. When members of an organization would do such mappings themselves, they
would streamline these descriptions to only include their particular arrangement or structure
(i.e., the answers to the questions for their organization). When they were done mapping their
current state, they would have a list of the processes and who was performing them. Accountability
is very important to effective incident management.
Using this organization-specific information, the process workflow for an organization will
look different from our generic workflow shown above in Figure 6. It will show the workflow
or routes of the work and who is responsible for performing the work. This type of diagram
is called a “swimlane” diagram. More information about swimlane diagrams can be
found in Section 3, “Overview of Process Mapping.”
To see an example of this mapping process and the resulting swimlane diagram, do the following:
1. Look at the Detect Events workflow diagram on page 98 and its corresponding workflow
description on page 100.
2. An organization’s documentation of its own as-is process for Detect might result in the
workflow description shown in Table 2. Notice that instead of the multitude of key people
or technologies that are listed in the generic Detect Events workflow diagram, this
table only includes the actors performing each subprocess and the technologies currently
being used to perform the process for this example organization.
3. When we actually map this process, knowing the responsible actors, we get the swimlane
diagram depicted in Figure 8, which shows the workflow and associated actor. 22
Once the as-is state is documented, and depending on the goal or outcome you are looking
for in your process mapping work, you can benchmark your workflows against our best practice
incident management process model to determine gaps and weaknesses. This is a traditional
gap analysis. During this process, you would look for characteristics of the processes
such as
• missing or poorly defined handoffs
• missing or poorly defined aspects of each process activity (e.g., no procedures in place or
inadequate staff)
• bottlenecks in the process
• poorly defined activity flows (e.g., too much parallelism, too linear, too many handoffs)
22
Note that we only show the workflow description for Detect, but the swimlane diagram also includes
the Triage and Respond processes. There would be a similar workflow description for Triage
and Respond that would have been done, before the swimlane diagram was completed as
shown here.
CMU/SEI-2004-TR-015 29