CERT Resilience Management Model, Version 1.0

taking remedial action to repair defective work products or services changing the plan for performing the process adjusting resources (people, tools, etc.) negotiating changes to the established commitments securing change to the requirements and objectives that have to be satisfied terminating the effortIf corrective action is required, further analysis may be necessary to identifyimprovements to the process.7. Track corrective action to closure.GG2.GP9 Objectively Evaluate AdherenceObjectively evaluate adherence of the process against its processdescription, standards, and procedures and addressnoncompliance.The purpose of this practice is to provide assurance that the process isimplemented as planned and adheres to its process description, standards,and procedures as evidenced through an evaluation of selected workproducts of the process. The evaluation must be independent; that is, thosedirectly involved in the performance of the process cannot perform theobjective evaluation or render an opinion on adherence.Activities such as internal and external audits, post-event reviews, andcapability appraisals allow the organization to have an independent andobjective evaluation of the effectiveness of the risk management process,adherence to the process, and identification of areas of noncompliance.Objectively evaluating adherence is especially important under times ofstress (such as during incident response) to ensure that the organization isrelying on processes and not reverting to ad hoc practices that requirepeople and technology as their basis.GG2.GP10 Review Status with Higher Level ManagersReview the activities, status, and results of the process with higherlevel managers and resolve issues.As a part of governing the operational resilience management process,higher level managers are provided with the appropriate visibility into theprocess.Higher level managers includes those in the organization above theimmediate level of managers responsible for the process. This informationis provided to help higher level managers to provide and enforce policy forthe process, as well as to perform overall guidance. (This practice is notperformed to help those who perform the direct day-to-day monitoring andcontrolling of the process.)Different managers have different needs for information about the process.These reviews help ensure that informed decisions on the planning and204 | CMU/SEI-2010-TR-012