CERT Resilience Management Model, Version 1.0

for protecting and sustaining assets and services. The organization should seek the optimummix in contrast to, for example, deploying an extensive number of overlapping and redundantcontrols in reaction to new compliance requirements.In the Controls Management process area, the organization establishes control objectivesthat reflect the organization’s objectives and mission and defines the target for thedevelopment of enterprise and operational-level controls. Enterprise controls are developedto address organization-wide directives that universally affect all operational layers.Operational controls are developed, implemented, monitored, analyzed, and managed at theservices level to ensure services meet their mission and, specifically, that assets related toservices are protected from disruption. These controls may be administrative, technical, orphysical in nature and typically are implemented in layers to reinforce strategies to protectand sustain assets and to meet control objectives. Enterprise and operational controls areanalyzed and validated to ensure that they meet control objectives as implemented; gaps ineffectiveness are identified on a periodic basis and addressed so that control objectives areattained on a consistent basis. It should be noted that the internal control environment in anorganization is vast; however, in Controls Management the focus is on controls that relatedirectly to the deployment of people and the use of information, technology, and facilities inexecuting services. Depending on the organization, this may include administrative controls,such as separation of duties, or more specific controls, such as the implementation of aphysical access control system at a facility. In other words, the subset of operational controlsused by the organization to ensure operational resilience is specific to the high-valueservices that the organization relies on to carry out its mission. Thus, this subset is likely onlya small part of the organization’s overall internal control system.The Controls Management and Service Continuity process areas establish the range ofcontrols necessary to ensure that services meet their missions even when disrupted.Controls Management focuses on controls that support protection and sustainmentstrategies—those that help to prevent services and assets from exposure to vulnerabilitiesand threats and those that help services and assets respond and recover when disrupted.However, all threat conditions cannot be known or anticipated. Service Continuity alsofocuses on sustaining services and assets under degraded conditions and in returning themto a normal operating state when possible. Service Continuity is also important becausecontrols that have been implemented may not always meet control objectives, or may not beoperating effectively. In these cases, until control remediation actions can occur, the servicecontinuity process sustains services and their supporting assets in the near term.Related Process AreasStrategic goals, objectives, critical success factors, and governance for operational resiliencemanagement process, as well as the identification of high-value services, are addressed inthe Enterprise Focus process area.Identification, analysis, and mitigation strategies for operational risks are addressed in theRisk Management process area.Ensuring compliance with identified obligations related to managing operational resilience,including those satisfied by the internal control system, is addressed in the Complianceprocess area.The relationship between assets and services is established in the Asset Definition andManagement process area.116 | CMU/SEI-2010-TR-012