CERT Resilience Management Model, Version 1.0

Communications stakeholderA person or group that has a vested interest in being involved in or a beneficiary of theorganization’s resilience communications activities. [COMM]Compliance (COMP)An enterprise process area in CERT-RMM. The purpose of Compliance Management is to ensureawareness of and compliance with an established set of relevant internal and external guidelines,standards, practices, policies, regulations, and legislation, and other obligations (such as contractsand service level agreements) related to managing operational resilience.ComplianceA process that characterizes the activities that the organization performs to identify the internaland external guidelines, standards, practices, policies, regulations, and legislation to which theyare subject and to comply with these obligations in an orderly, systematic, efficient, timely, andaccurate manner. [COMP]Compliance knowledgebaseA common accessible information repository for compliance data. The repository may includedocumentation of the compliance obligations and their owners and due dates, the results ofcompliance and substantive testing of controls, compliance targets and metrics, compliancereports, non-compliance reports, remediation plans, and tracking data to provide status onsatisfying compliance obligations. [COMP]Compliance obligationsThe internal and external guidelines, standards, practices, policies, regulations, and legislation thatthe organization has an obligation to comply with. [COMP]ConditionA term that collectively describes a vulnerability, an actor, a motive, and an undesirable outcome.A condition is essentially a threat that the organization must identify and analyze to determine ifexploitation of the threat could result in undesirable consequences. [RISK] (See related glossaryterm “consequence.”)ConfidentialityFor an asset, the quality of being accessible only to authorized people, processes, and devices.[KIM]Configuration itemAn asset or a series of related assets (typically information or technology-focused) that are placedunder configuration management processes. [KIM] [TM]Configuration managementA process for managing the integrity of an information or technology asset over its lifetime.Typically includes change control processes. [KIM] [TM]ConsequenceThe unwanted effect, undesirable outcome, or impact to the organization as the result ofexploitation of a condition or threat. [RISK] (See related glossary term “condition.”)217 | CMU/SEI-2010-TR-012