CERT Resilience Management Model, Version 1.0

4. Update asset profiles to establish and document the asset’sassociation to a service.If the asset is connected to more than one service, be sure this is noted as part of theasset profile.5. Update the asset database with asset-to-service associationinformation.All information relevant to the asset (collected from the asset profile) should becontained with the asset in its entry in the asset database.ADM:SG2 Establish the Relationship Between Assets and ServicesThe relationship between assets and the services they support is establishedand examined.The relationship between assets and the services they support must be understood inorder to effectively develop, implement, and manage resilience strategies that supportthe accomplishment of the service’s mission. Associating assets to services helps theorganization to determine where critical dependencies exist, to validate resiliencerequirements, and to develop and implement commensurate resilience strategies.ADM:SG2.SP1 Associate Assets with ServicesAssets are associated with the service or services they support.To provide a service-focused review of operational resilience, the assetscollected in the development of the asset inventory must be associated withthe services they support. This helps the organization view resilience from aservice perspective and to identify critical dependencies that are essentialto determining effective strategies for protecting and sustaining assets.Establishing criteria for determining the relative value of services andassociated assets is performed in the Risk Management process area.Identifying and prioritizing high-value organizational services is performed inthe Enterprise Focus process area.Typical work products1. List of high-value services and associated assets2. Updated asset profiles (including service information)3. Updated asset database (including service information)Subpractices1. Identify high-value services.A list of high-value services is created in the Enterprise Focus process area. Assetscan be associated with services in this practice, but it is best to have a validated list ofservices to which assets are associated. Refer to the Enterprise Focus process areafor more information.2. Assign assets in the asset database to one or more services.3. Update the asset profile to reflect the service association.4. Update the asset database to reflect the service association.88 | CMU/SEI-2010-TR-012