CERT Resilience Management Model, Version 1.0

Required CERT-RMM Process AreasAssociation with FISMA,NIST Supporting DocumentsNotesCategoryProcess AreaMinimumRequiredCapabilityLevelOperationsTechnologyManagement (TM)Level 2FISMA – Select SecurityControlsFISMA – Develop SystemConfiguration RequirementsFISMA – Implement SecurityControlsTM addresses securitycontrols specifically fortechnology assetsincluding software,hardware, systems, andnetworksFIPS 200NIST SP 800-53NIST SP 800-70OperationsVulnerability Analysisand Resolution (VAR)Level 2FISMA – Assess SecurityControlsFISMA – Monitor SecurityStateNIST SP 800-53AConsidered part ofFISMA riskmanagement, althoughis a separate process inCERT-RMMNIST SP 800-37OMB Memorandum M-10-15Managing Cloud ComputingA suggested (but not all-inclusive) targeted improvement roadmap for determining how well theorganization is managing the potential risks when using cloud computing services is providedbelow.Process AreasAsset Definition andManagementExternal DependenciesManagementSelection RationaleAsset Definition and Management (ADM) is focused on the resilience of servicecriticalassets. Managing the risks from cloud computing means that theorganization has processes in place to identify and document assets, establishownership and custodianship for assets, and link assets to the services theysupport. The concept of asset ownership and custodianship are especiallyimportant in the cloud computing environment to establish clear lines ofdemarcation and responsibility for operational resilience.In External Dependencies Management (EXD), the organization’s process foridentifying, analyzing, and addressing the risks associated with the actions ofservice providers, the formalization of the relationship with such providers, and theongoing management of provider relationships are established. An externaldependency exists when an external entity has access to, control of, ownership in,possession of, responsibility for (including development, operations, maintenance,or support), or other defined obligations related to one or more assets or services ofthe organization. For cloud computing, managing external dependencies is anongoing concern over the life of the relationship.210 | CMU/SEI-2010-TR-012