CERT Resilience Management Model, Version 1.0

GG2.GP8 Monitor and Control the ProcessMonitor and control the process against the plan for performingthe process and take appropriate corrective action.The purpose of this practice is to perform the direct day-to-day monitoringand controlling of the process. Appropriate visibility into the process ismaintained so that appropriate corrective action can be taken whennecessary. Monitoring and controlling the process involves establishingappropriate metrics and measuring appropriate attributes of the process orwork products produced by the process. The metrics and measurementsmay be qualitative or quantitative as appropriate.Refer to the Monitoring process area for more information about collecting,organizing, and distributing data that may be useful for monitoring andcontrolling processes.Refer to the Measurement and Analysis process area for more informationabout establishing process metrics and measurement.Refer to the Enterprise Focus process area for more information aboutproviding process information to managers, identifying issues, anddetermining appropriate corrective actions.Subpractices1. Measure actual performance against the plan for performing theprocess.The measures are of the process, its work products, and its services.2. Review accomplishments and results of the process against the planfor performing the process.3. Review activities, status, and results of the process with the immediatelevel of managers responsible for the process and identify issues.The reviews are intended to provide the immediate level of managers with appropriatevisibility into the process. The reviews can be both periodic (for example, planned aspart of a regular audit of the organization’s internal control system) and event driven.Process reviews are likely to concentrate on the effectiveness and efficiency of theinternal control system for services and assets, as well as the satisfaction of serviceand asset resilience requirements.4. Identify and evaluate the effects of significant deviations from the planfor performing the process.5. Identify problems in the plan for performing and executing the process.6. Take corrective action when requirements and objectives are not beingsatisfied, when issues are identified, or when progress differssignificantly from the plan for performing the process.New risks that could be introduced or affect the mitigation plans for existing risksshould be considered before any corrective action is taken. Refer to the RiskManagement process area for more information about managing risk.Corrective actions may include the following:203 | CMU/SEI-2010-TR-012