CERT Resilience Management Model, Version 1.0

Technical Solution, the purpose of which is to design, develop, and implement solutionsto software and system requirements. Solutions, designs, and implementationsencompass software and system products, product components, and product-related lifecycleprocesses, either singly or in combination as appropriate.There are a growing number of reputable sources to consider when identifying and selectingcandidate guidelines for the development of resilient software and systems across the lifecycle, particularly for software security and assurance.These are examples of sources of guidelines: Building Security In Maturity Model (BSIMM2) v2.0http://www.bsi-mm.com/ Open Web Applications Security Project (OWASP) Software Assurance Maturity Model (SAMM) v1.0http://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model Microsoft’s Security Development Life Cycle, Version 4.1http://www.microsoft.com/security/sdl/Department of Homeland Security Assurance for CMMI Process Reference Modelhttps://buildsecurityin.us-cert.gov/swa/procwg.htmlThe Resilient Technical Solution Engineering process area assumes that the organizationhas one or more existing, defined processes for software and system development intowhich resilience controls and activities can be integrated. If this is not the case, theorganization should not attempt to implement the goals and practices identified in thisprocess area.Note: This process area does not address the unique aspects of the resilience of embeddedsystems or the resilience of hardware that is part of a software-intensive system.Related Process AreasResilience requirements for software and system technology assets in operation, includingthose that may influence quality attribute requirements in the development process, aredeveloped and managed in the Resilience Requirements Development and ResilienceRequirements Management process areas respectively.Identifying and adding newly developed and acquired software and system assets to theorganization’s asset inventory is addressed in the Asset Definition and Management processarea.The management of resilience for technology assets as a whole, particularly for deployed,operational assets, is addressed in the Technology Management process area. Thisincludes, for example, asset fail-over, backup, recovery, and restoration.Acquiring software and systems from external entities and ensuring that such assets meettheir resilience requirements throughout the asset life cycle is addressed in the ExternalDependencies Management process area. That said, RTSE specific goals and practicesshould be used to aid in evaluating and selecting external entities that are developingsoftware and systems (EXD:SG3.SP3), formalizing relationships with such external entities(EXD:SG3.SP4), and managing an external entity’s performance when developing softwareand systems (EXD:SG4).180 | CMU/SEI-2010-TR-012