CERT Resilience Management Model, Version 1.0

Appendix B: Targeted Improvement RoadmapsAchieving FISMA ComplianceA suggested targeted improvement roadmap 13 for using CERT-RMM to achieve FISMAcompliance is provided below.Required CERT-RMM Process AreasAssociation with FISMA,NIST Supporting DocumentsNotesCategoryProcess AreaMinimumRequiredCapabilityLevelOperationsAccess Management(AM)Level 2 14FISMA – Select SecurityControlsFISMA – Implement SecurityControlsStrong connection toIdentity Management inCERT-RMMFIPS 200NIST SP 800-53NIST SP 800-70OMB Memorandum M-10-15EngineeringAsset Definition andManagement (ADM)Level 2FISMA – CategorizeInformation SystemsFIPS 199NIST SP 800-60OMB Memorandum M-10-15Level 1 base practices inADM more broadly coverall asset types—people,information, technology,and facilities—whileFISMA is focused oninformation systems.EnterpriseManagementEnterprise Focus(EF)Level 1FISMA – EstablishOrganizational ViewNIST SP 800-39OMB Memorandum M-10-15Level 1 base practices inCERT-RMM are moreextensive than requiredby FISMA or NIST 800-39’s ―organizationalview.‖1314See page 69 for more information about using CERT-RMM targeted improvement roadmaps.Because of the FISMA emphasis on policies and procedures to support security programs, these process areasare raised to level 2 capability in CERT-RMM, which addresses elements of process capability (such as policy,governance, resources, training, monitoring, and control) that support a ―managed‖ level of operationalresilience management. Without FISMA policy requirements, these capability levels could be established atlevel 1.207 | CMU/SEI-2010-TR-012