CERT Resilience Management Model, Version 1.0

ADM:GG2.GP3 Provide ResourcesProvide adequate resources for performing the asset definition andmanagement process, developing the work products, andproviding the services of the process.Subpractices1. Staff the process.Elaboration:The diversity of asset types (people, information, technology, facilities) requires thatstaff members assigned to the asset definition and management process haveappropriate knowledge of the assets being inventoried and the services with whichthey are associated.These are examples of staff required to perform the asset definition and managementprocess: staff responsible for- identifying high-value assets (e.g., people, information, technology, andfacilities) and the services with which they are associated- developing and maintaining the asset inventory, including asset profilesand the asset database- identifying asset dependencies, potential conflicts, and mitigation plansto reduce the effects of dependencies that could affect the operationalresilience of associated services- managing changes to assets, changes to the asset inventory, andassociated changes to requirements, controls, strategies, and plans.This includes communicating changes to affected stakeholders,including asset custodians.- developing process plans and programs andensuring they are aligned with stakeholder requirements and needs- managing external entities that have contractual obligations for assetdefinition and management activities owners and custodians of high-value assets that support the accomplishment ofoperational resilience management objectives internal and external auditors responsible for reporting to appropriate committeeson process effectivenessRefer to the Organizational Training and Awareness process area forinformation about training staff for resilience-focused roles andresponsibilities.Refer to the Human Resource Management process area forinformation about acquiring staff to fulfill roles and responsibilities.95 | CMU/SEI-2010-TR-012