CERT Resilience Management Model, Version 1.0

4BSummary of Specific Goals and PracticesGoalsIMC:SG1 Establish the Incident Managementand Control ProcessIMC:SG2 Detect EventsIMC:SG3 Declare IncidentsIMC:SG4 Respond to and Recover fromIncidentsIMC:SG5 Establish Incident LearningPracticesIMC:SG1.SP1 Plan for Incident ManagementIMC:SG1.SP2 Assign Staff to the Incident Management PlanIMC:SG2.SP1 Detect and Report EventsIMC:SG2.SP2 Log and Track EventsIMC:SG2.SP3 Collect, Document, and Preserve Event EvidenceIMC:SG2.SP4 Analyze and Triage EventsIMC:SG3.SP1 Define and Maintain Incident Declaration CriteriaIMC:SG3.SP2 Analyze IncidentsIMC:SG4.SP1 Escalate IncidentsIMC:SG4.SP2 Develop Incident ResponseIMC:SG4.SP3 Communicate IncidentsIMC:SG4.SP4 Close IncidentsIMC:SG5.SP1 Perform Post-Incident ReviewIMC:SG5.SP2 Integrate with the Problem Management ProcessIMC:SG5.SP3 Translate Experience to StrategySpecific Practices by GoalIMC:SG1 Establish the Incident Management and Control ProcessThe organizational process for identifying, analyzing, responding to, andlearning from incidents is established.IMC:SG2 Detect EventsIMC:SG1.SP1 Plan for Incident ManagementPlanning is performed for developing and implementing theorganization’s incident management and control process.IMC:SG1.SP2 Assign Staff to the Incident Management PlanStaff are identified and assigned to the incident management plan.Establish and maintain a process for detecting, reporting, triaging, andanalyzing events.IMC:SG2.SP1 Detect and Report EventsEvents are detected and reported.IMC:SG2.SP2 Log and Track EventsEvents are logged and tracked from inception to disposition.IMC:SG2.SP3 Collect, Document, and Preserve Event EvidenceThe process for collecting, documenting, and preserving eventevidence is established and managed.142 | CMU/SEI-2010-TR-012