CERT Resilience Management Model, Version 1.0

RESILIENCE REQUIREMENTS DEVELOPMENTEngineeringPurposeThe purpose of Resilience Requirements Development is to identify, document, and analyzethe operational resilience requirements for high-value services and related assets.Introductory NotesAn operational resilience requirement is a constraint that the organization places on theproductive capability of a high-value asset to ensure that it remains viable and can besustained when charged into production to support a high-value service. In practice,operational resilience requirements are a derivation of the traditionally described securityobjectives of confidentiality, integrity, and availability. Well known as descriptive properties orquality attributes of information assets, these objectives are also extensible to other types ofassets—people, technology, and facilities—with which operational resilience management isconcerned.Resilience requirements provide the foundation for protecting assets from threats andsustaining them to the extent practical and possible so that they can perform as intended insupport of services. In essence, resilience requirements become a part of an asset’s DNA(just like its definition, owner, and value) that transcends departmental and organizationalboundaries because they stay with the asset regardless of where it is deployed or operated.Requirements drive engineering-based processes, such as operational resiliencemanagement. In the operational resilience management process, the ResilienceRequirements Development process area requires the organization to establish resiliencerequirements at the enterprise, service, and asset levels. Resilience requirements also driveor influence many of the process areas in the definition of the operational resiliencemanagement process. For example, resilience requirements form the basis for developingcontrols and strategies for protecting assets (Controls Management) and for developingservice continuity plans for services and assets (Service Continuity).The importance of requirements to the operational resilience management process cannotbe overstated. Resilience requirements embody the strategic objectives, risk appetite, criticalsuccess factors, and operational constraints of the organization. They represent thealignment factor that ties practice-level activities performed in security and businesscontinuity to what must be accomplished at the service and asset level in order to move theorganization toward fulfilling its mission.Depending on the organization, three types of operational resilience requirements may beelicited: enterprise, service, and asset.Enterprise. Enterprise operational resilience requirements reflect enterprise-levelneeds, expectations, and constraints. These requirements affect nearly all aspects of anorganization’s operations. Laws and regulations are examples of this type of requirementbecause they broadly affect the business in which an organization operates and must bemet by all organizational functions and activities. A specific example of an enterprise171 | CMU/SEI-2010-TR-012