CERT Resilience Management Model, Version 1.0

Part One: About the CERT ® Resilience Management ModelOrganizations in every sector—industry, government, and academia—face increasingly complexbusiness and operational environments. They are constantly bombarded with conditions andevents that can introduce stress and uncertainty that may disrupt the effective operation of theorganization.Stress related to managing operational resilience—the ability of the organization to achieve itsmission even under degraded circumstances—can come from many sources. For example,Technology advances are helping organizations to automate business processes and makethem more effective at achieving their missions. But the cost to organizations is that thetechnology often introduces complexities, takes specialized support and resources, andcreates an environment that is rife with vulnerabilities and risks.Organizations increasingly depend on partnerships to achieve their mission. Externalpartners provide essential skills and functions, with the aim of increasing productivity andreducing costs. As a result, the organization must expose itself to new risk environments. Byemploying a chain of partners to execute a business process, the organization cedes controlof mission assurance in exchange for cost savings.The increasing globalization of organizations and their supply chains poses a problem formanagement in that governance and oversight must cross organizational and geographicallines like never before. And it must be acknowledged that the emerging worldwidesociopolitical environment is forcing organizations to consider threats and risks that havepreviously not been on their radar screens. Recent well-publicized events have changed theview of what is feasible and have expanded the range of outcomes that an organization mustattempt to prevent and from which it must be prepared to recover.All of these new demands conspire to force organizations to rethink how they perform operationalrisk management and how they address the resilience of critical business services and processes.The traditional, and typically compartmentalized, disciplines of security, business continuity, andIT operations must be expanded to provide protection and continuity strategies for critical servicesand supporting assets that are commensurate with these new operating complexities.In addition, organizations lack a reliable means to answer the question, How resilient am I? Theyalso lack the ability to assess and measure their capability for managing operational resilience(Am I resilient enough?), as they have no credible yardstick against which to measure. Typically,capability is measured by the way that an organization has performed during an event, or it isdescribed in vague terms that cannot be measured. For example, when organizations are asked todescribe how well they are managing resilience, they typically characterize success in terms ofwhat hasn’t happened: “We haven’t been attacked; therefore we must be doing everything right.”Because there will always be new and emerging threats, knowing how well the organizationperformed today is necessary but not sufficient; it is more important to be able to predict how itwill perform in the future when the risk environment changes.CERT recognizes that organizations face challenges in managing operational resilience incomplex environments. The solution to addressing these challenges must have several1 | CMU/SEI-2010-TR-012