CERT Resilience Management Model, Version 1.0

ADM:GG2.GP6 Manage Work Product ConfigurationsPlace designated work products of the asset definition andmanagement process under appropriate levels of control.Elaboration:ADM:SG3.SP2 specifically addresses the change control process overassets and the asset inventory. However, other work products of the assetdefinition and management process must also be managed and controlled.The tools, techniques, and methods used to capture and maintain the assetinventory should be employed to perform consistent and structured versioncontrol over the inventory to ensure that information is current, accurate,and “official.” The tools, techniques, and methods can also be used tosecurely store the asset inventory, provide access control over inquiry,modification, and deletion, and to track version changes and updates.These are examples of asset definition and management work products placed undercontrol:asset inventoryasset databaseasset profilesasset owners and custodiansassociation of assets to high-value servicesasset dependencies, dependency conflicts, mitigation actions, and resolutionsasset inventory change control system or methodasset inventory change criteriaprocess planpolicies and procedurescontracts with external entitiesADM:GG2.GP7 Identify and Involve Relevant StakeholdersIdentify and involve the relevant stakeholders of the assetdefinition and management process as planned.Elaboration:Several ADM specific practices address the involvement of owners andcustodians as key stakeholders in the asset definition and managementprocess. For example, ADM:SG1.SP3 calls for establishing ownership andcustodianship for all high-value assets and making sure owners andcustodians understand their responsibilities, as well as their relationshipwith one another. ADM:SG3.SP1 requires that asset owners haveknowledge of asset change criteria, including possible changes in assetownership and custodianship.99 | CMU/SEI-2010-TR-012