CERT Resilience Management Model, Version 1.0

The identification, definition, and management of facility assets is addressed in the AssetDefinition and Management process area.The risk management cycle for facility assets is addressed in the Risk Management processarea.The management of the internal control system that ensures the protection of facility assetsis addressed in the Controls Management process area.The selection, implementation, and management of access controls for facility assets isperformed in the Access Management process area.The development of service continuity plans for facilities is performed in the ServiceContinuity process area.The establishment and management of relationships with external entities to ensure theresilience of services that are executed in facilities they own and operate is addressed in theExternal Dependencies Management process area.Summary of Specific Goals and PracticesGoalsEC:SG1 Establish and Prioritize Facility AssetsEC:SG2 Protect Facility AssetsEC:SG3 Manage Facility Asset RiskEC:SG4 Control Operational EnvironmentPracticesEC:SG1.SP1 Prioritize Facility AssetsEC:SG1.SP2 Establish Resilience-Focused Facility AssetsEC:SG2.SP1 Assign Resilience Requirements to Facility AssetsEC:SG2.SP2 Establish and Implement ControlsEC:SG3.SP1 Identify and Assess Facility Asset RiskEC:SG3.SP2 Mitigate Facility RisksEC:SG4.SP1 Perform Facility Sustainability PlanningEC:SG4.SP2 Maintain Environmental ConditionsEC:SG4.SP3 Manage Dependencies on Public ServicesEC:SG4.SP4 Manage Dependencies on Public InfrastructureEC:SG4.SP5 Plan for Facility RetirementSpecific Practices by GoalEC:SG1 Establish and Prioritize Facility AssetsFacility assets are prioritized to ensure resilience of high-value services thatthey support.EC:SG1.SP1 Prioritize Facility AssetsFacility assets are prioritized relative to their importance insupporting the delivery of high-value services.EC:SG1.SP2 Establish Resilience-Focused Facility AssetsFacility assets that specifically support the organization’s servicecontinuity plans are identified and established.120 | CMU/SEI-2010-TR-012