CERT Resilience Management Model, Version 1.0

ADM:GG2.GP8 Monitor and Control the ProcessMonitor and control the asset definition and management processagainst the plan for performing the process and take appropriatecorrective action.Refer to the Monitoring process area for more information about thecollection, organization, and distribution of data that may be useful formonitoring and controlling processes.Refer to the Measurement and Analysis process area for more informationabout establishing process metrics and measurement.Refer to the Enterprise Focus process area for more information aboutproviding process information to managers, identifying issues, anddetermining appropriate corrective actions.Subpractices1. Measure actual performance against the plan for performing theprocess.2. Review accomplishments and results of the process against the planfor performing the process.Elaboration:These are examples of metrics for the asset definition and management process: percentage of organizational assets that have been inventoried, by asset type number or level of discrepancies between the current inventory and thedocumented inventory number of changes made to the asset inventory during a stated period number of assets that do not have an assigned owner or custodian (if applicable) number of assets with incomplete asset profiles or other incomplete information number of asset-service dependency conflicts with unimplemented or incompletemitigation plans number of high-value asset risks referred to the risk management process; numberof risks where corrective action is still pending (by risk rank) level of adherence to process policies; number of policy violations; number ofpolicy exceptions requested and number approved number of process activities that are on track per plan rate of change of resource needs to support the process rate of change of costs to support the process101 | CMU/SEI-2010-TR-012